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Abstract 

The research field of Agent- Oriented Software Engineering (AOSE) aims to find abstractions, lan- 
guages, methodologies and toolkits for modeling, verifying, validating and prototyping complex ap- 
plications conceptualized as Multiagent Systems (MASs). A very lively research sub-field studies 
how formal methods can be used for AOSE. This paper presents a detailed survey of six logic-based 
executable agent specification languages that have been chosen for their potential to be integrated 
in our ARPEGGIO project, an open framework for specifying and prototyping a MAS. The six 
languages are ConGolog, AGENT-0, the IMPACT agent programming language, Dylog, Concur- 
rent METATEM and Ehiif - For each executable language, the logic foundations are described and 
an example of use is shown. A comparison of the six languages and a survey of similar approaches 
complete the paper, together with considerations of the advantages of using logic-based languages in 
MAS modeling and prototyping. 

KEYWORDS: agent-oriented software engineering, logic-based language, multiagent system 



1 Introduction 

Today's software applications are typically extremely complex. They may involve het- 
erogeneous components which need to represent their knowledge about the world, about 
themselves, and about the other entities that populate the world, in order to reason about 

* Partially supported by the "Verifica di Sistemi Reattivi Basati su Vincoli (COVER)" project of the Programma 
di Ricerca Cofinanziato MIUR, Bando 2002, and by the "Discoveiy" project of the Australian Research Council 
number DP0209027. 
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the world, to plan future actions which should be taken to reach some final goal and to take 
rapid decisions when the situation demands a quick reaction. Since knowledge and compe- 
tencies are usually distributed, the components need to interact to exchange information or 
to delegate tasks. This interaction may follow sophisticated communication protocols. Due 
to component and system complexity, applications of this kind are difficult to be correctly 
and efficiently engineered. Indeed a very active research area has been working for almost 
twenty years finding abstractions, languages, methodologies and toolkits for modeling, 
verifying, validating and finally implementing applications of this kind. 

The underlying metaphor is that the components of complex real-world applications 
are intelligent agents. The agents interact, exchanging information and collaborating for 
reaching a common target, or compete to control some shared resource and to maximize 
their personal profit, building, in both cases, a society of agents, or multiagent system 
(MAS). 

An intelligent agent, according to a classical definition proposed by Jennings, Sycara 
and Wooldridge in ( [Jennings et al. 1998) , is 

"a computer system, situated in some environment, that is capable of flexible autonomous actions 
in order to meet its design objectives. 

Situatedness means that the agent receives sensory input from its environment and that it can perform 
actions which change the environment in some way. 

By autonomy we mean that the system should be able to act without the direct intervention of 
humans (or other agents), and that it should have control over its own actions and internal state. [. . . ] 
By flexible, we mean that the system is: 

• responsive: agents should perceive their environment and respond in a timely fashion to 
changes that occur in it; 

• pro-active: agents should be able to exhibit opportunistic, goal-directed behavior and take the 
initiative when appropriate; 

• social: agents should be able to interact, when appropriate, with other artificial agents and 
humans." 

Research on agent-oriented software engineering (AOSE) JPetrie 2000HCiancarini and Wooldridge 2000^ 
aims at providing the means for engineering applications conceptualized as MASs. As 
pointed out in jCiancarini and Wooldridge 2000^ , the use of formal methods is one of the 
most active areas in this field, where formal methods play three roles: 

• in the specification of systems; 

• for directly programming systems; and 

• in the verification of systems. 

We think that logic-based formal methods can be very effective for fitting all three roles. In 
fact, the current predominant approach to specifying agents has involved treating the agents 
as intentional systems that may be understood by attributing to them mental states such as 
beliefs, desires and intentions fPennett 1987 "Wooldridge and Jennings 1 995l|Wooldridge 2000^ . 
A number of approaches for formally specifying agents as intention systems have been 
developed, capable of representing beliefs, goals and actions of agents and the ongoing 
interaction among them. A large number of logics appear successful at formalizing these 
concepts in a very intuitive and natural way, including for example modal logic, temporal 
logic and deontic logic. 
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Further, there are various logic-based languages for which a working interpreter or an 
automatic mechanism for animating specifications exists. When these languages are used 
to specify agents, a working prototype of the given specification is obtained for free and 
can be used for early testing and debugging of specification. Most of the executable logic- 
based languages suffer from significant limitations (very low efficiency, poor scalability 
and modularity, no support for physical distribution of the computation nor for integration 
of external packages and languages) which make them only suitable for building simple 
prototypes. Nevertheless, even if these languages will never be used to build the final ap- 
plication, their execution can give useful and very quick feedback to the MAS developer, 
who can take advantage of this early testing and debugging for iteratively refining the MAS 
specification. 

Additionally, verification is the process of showing that an implemented system is cor- 
rect with respect to its original specification. If the language in which the system is im- 
plemented is axiomatizable, deductive (axiomatic) verification is possible. Otherwise, the 
model checking semantic approach can be followed: given a formula </? of a logic L and a 
model 7W for L, determine whether or not M \=l (p. There are logic-based languages 
which have been axiomatized, allowing an axiomatic verification, and other languages 
which can be used for model checking. 

Logic -based formalisms are suitable for the stages of specification, direct execution and 
verification of MAS prototypes. We could ask if some environment and methodology ex- 
ist that provide a set of logic-based languages for iteratively facing these stages inside a 
common framework, until a working prototype that behaves as expected is obtained. A pre- 
liminary answer can come from ARPEGGIO. ARPEGGIO (Agent based Rapid Prototyp- 
ing Environment Good for Global Information Organization JDart et al. 19991 IZini 2000l 
IMascardi 2002 1) is an open framework where specification, execution and verification of 
MAS prototypes can be carried on choosing the most suitable language or languages from 
a set of supported ones. 

The rationale behind ARPEGGIO is that MAS development requires engineering sup- 
port for a diverse range of software quality attributes. It is not feasible to create one mono- 
lithic AOSE approach to support all quality attributes. Instead, we expect that different 
approaches will prove suitable to model, verify, or implement different quality attributes. 
By providing the MAS developer with a large set of languages and allowing the selection of 
the right language to model, verify or implement each quality attribute, ARPEGGIO goes 
towards a modular approach to AOSE (J uan et al. 200 3b Ju an et al. 2003at . ARPEGGIO 
is conceived as the framework providing the building blocks for the development of an 
hybrid, customizable AOSE methodology. It is not conceived as an hybrid system. 

ARPEGGIO draws from three international logic programming research groups: the 
Logic Programming Group at the Computer Science Department of the University of 
Maryland, USA; the Logic Programming and Software Engineering Group at the Computer 
Science & Software Engineering Department of the University of Melbourne, Australia; 
and the Logic Programming Group at the Computer Science Department of the University 
of Geneva, Italy. An instance of the ARPEGGIO framework, CaseLP JMarteUi et al. 1999bl 
IMartellietal. 1999al IMarini et al. 2000l IZini 20001 IMascardi 20021 . has been developed 
and tested on different real-world applications. CaseLP provides a language based on 
linear-logic, £hhf (.Delzanno 1997..Delzanno and Martelli 2001 J . to specify and verify agent 
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specifications. This language, described in Section lOl can also be executed, allowing the 
direct programming of the code for the prototypical agents. Besides this high-level lan- 
guage, CaseLP provides an extension of Prolog for directly developing the MAS pro- 
totype. Although CaseLP demonstrates that the concepts underlying the ARPEGGIO 
framework can be put into practice and can give interesting results, the set of languages 
it provides is quite limited. Our motivation behind the development of ARPEGGIO is to 
provide a broader set of languages so that the prototype developer can choose the most 
suitable ones to model and/or program different features of a MAS. 

There are two main purposes of this paper The first is to analyze a set of logic-based lan- 
guages which have proven useful to specify, execute and/or validate agents and MAS pro- 
totypes and which have been integrated or could be integrated into the ARPEGGIO frame- 
work. The set we have chosen consists of ConGolog fDe Giacomo et al. 2000 1, AGENT-0 
(k,Shoham 1993 1, the IMPACT agent language (Eit eret al. 1999 1, Dylog (Baldoni et al. 2000j, 
Concurrent METATEM ( |Fisher and Barringer 1991t and Shhf JDelza nno and Mar telli 200 U . 
These languages have been chosen because, consistent with the ARPEGGIO philosophy, 
a working interpreter exists for them and they provide useful features for specifying agent 
systems. Other languages possess these features (see SectionfTol and could have been cho- 
sen for being analyzed in this paper and for a future integration in ARPEGGIO. However 
we preferred to provide a focused survey of a small subset of languages rather than a super- 
ficial description of a large set. In order to reach a real understanding of the main features 
of the languages described in this paper we have developed a common running example in 
all of them. 

The second purpose of this paper is to describe the different logics and calculi the ex- 
ecutable languages we take into consideration are based on, in order to provide a com- 
prehensive survey on formalisms suitable to model intelligent agents. Some executable 
languages are based on more than one logic; for example Concurrent METATEM is based 
on modal and temporal logic, and AGENT-0 is based on modal and deontic logic. The 
classification we give of agent languages takes into account the predominant logic upon 
which the language is based. 

The structure of the paper is the following: 

• Section|2]describes the running example we will use throughout this paper to practi- 
cally exemplify the features of the languages we will analyze; 

• Section |3l introduces the situation calculus and the ConGolog agent programming 
language based on it; 

• Sectionl^discusses modal logic and the AGENT-0 language; 

• in Section|5]the main features of deontic logic are shown and the IMPACT program- 
ming language is analyzed as an example of an agent language including deontic 
operators; 

• Section|6ldiscusses dynamic logic and the Dylog agent language based on it; 

• Section0describes temporal logic and the Concurrent METATEM agent program- 
ming language; 

• Section |8] introduces linear logic and analyses the Shhf language included in the 
CaseLP instance of the ARPEGGIO framework; 

• Section|9lcompares the agent programming languages introduced so far based on a 
set of relevant AOSE features they can support; 
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Figure 1. The contract proposal protocol. 



• SectionfToldiscusses related work; 

• finally, Section^Jconcludes the paper. 



2 The Running Example 

To show how to define an agent in the various agent languages we discuss in this paper, 
we use a simple example of a seller agent in a distributed marketplace which follows the 
communication protocol depicted in Figure^ The notation used in this figure is based on 
an agent-oriented extension of UML (Odell et a l. 2000allbdell et a l. 2000b); the diamond 
with the X inside represents a "xor" connector and the protocol can be repeated more than 
once (note the bottom arrow from the buyer to the seller labeled with a "contractProposal" 
message, which loops around and up to point higher up to the seller time line). 

The seller agent may receive a COntractProposal message from a buyer agent. Accord- 
ing to the amount of merchandise required and the price proposed by the buyer, the seller 
may accept the proposal, refuse it or try to negotiate a new price by sending a contract- 
Proposal message back to the buyer The buyer agent can do the same (accept, refuse or 
negotiate) when it receives a COntractProposal message back from the seller 

The rules guiding the behavior of the seller agent are the following: 

if the received message is contractProposal(merchandise, amount, proposed- 
price) then 

— if there is enough merchandise in the warehouse and the price is greater or 
equal than a max value, the seller accepts the proposal by sending an accept 
message to the buyer and concurrently ships the required merchandise to the 
buyer (if it is not possible to define concurrent actions, answering and shipping 
merchandise will be executed sequentially); 

— if there is not enough merchandise in the warehouse or the price is lower or 
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equal than a min value, the seller agent refuses the proposal by sending a 
refuse message to the buyer; 
— if there is enough merchandise in the warehouse and the price is between min 
and max, the seller sends a COntractProposal to the buyer with a proposed 
price evaluated as the mean of the price proposed by the buyer and max (we 
will sometimes omit the definition of this function, which is not of central 
interest in our example) . 

In our example, the merchandise to be exchanged are oranges, with minimum and maxi- 
mum price 1 and 2 euro respectively. The initial amount of oranges that the seller possesses 
is 1000. 

Our example involves features which fall in the intersection of the six languages and 
it is therefore quite simple. An alternative choice to providing a simple unifying exam- 
ple would consist of providing six sophisticated examples highlighting the distinguishing 
features of each of the six languages. However, while sophisticated ad-hoc examples can 
be found in the papers discussing the six languages, a unifying (though simple) example 
had not been proposed yet. Consistent with the introductory nature of our paper and with 
the desire to contribute in an original way to the understanding of the six languages, we 
opted for the simple unifying example, which is both introductory and original. The about 
seventy references included in the following six sections should help the reader in finding 
all the documents she/he needs for deepening her/his knowledge about the six languages 
discussed in this paper. 

3 Situation Calculus 

The situation calculus f McCarthy 1963H is well-known in AI research. More recently there 
have been attempts to axiomatize it. The following description is based uponlP irri and Reiter 1999I I. 
^sit-caic is a second order language with equality. It has three disjoint sorts: action for ac- 
tions, situation for situations and a catch-all sort object for everything else depending on 
the domain of application. Apart from the standard alphabet of logical symbols (A, ^ and 
3, used with their usual meaning), Csu-caic has the following alphabet: 

• Countably infinitely many individual variable symbols of each sort and countably 
infinitely many predicate variables of all arities. 

• Two function symbols of sort situation: 

1 . A constant symbol 5*0, denoting the initial situation. 

2. A binary function symbol do : action x situation situation. 

do{a, s) denotes the successor situation resulting from performing action a in 
situation s. 

• A binary predicate symbol C: situation x situation, defining an ordering relation 
on situations. The intended interpretation of situations is as action histories, in which 
case s C s' means that s' can be reached by s by a finite application of actions. 

• A binary predicate symbol Poss : action x situation. The intended interpretation 
of Poss{a, s) is that it is possible to perform the action a in the situation s. 



Logic-Based Specification Languages for Intelligent Software Agents 7 



• Countably infinitely many predicate symbols used to denote situation independent 
relations and countably infinitely many function symbols used to denote situation 
independent functions. 

• A finite or countably infinite number of function symbols called action functions and 
used to denote actions. 

• A finite or countably infinite number of relational Euents (predicate symbols used to 
denote situation dependent relations). 

• A finite or countably infinite number of function symbols called functional fluents 
and used to denote situation dependent functions. 

In the axiomatization proposed in ( |Levesque et al. 1998^ , axioms are divided into do- 
main axioms and domain independent foundational axioms for situations. Besides axioms, 
( p.^evesque et al. 1998^ also introduces basic theories of actions and a metatheory for the 
situation calculus which allows to determine when a basic action theory is satisfiable and 
when it entails a particular kind of sentence, called regressable sentences. Here we only 
discuss domain independent foundational axioms for situations. Since the scope of this pa- 
per is to provide introductory material which can be understood with little effort, we will 
address neither domain axioms nor the metatheory for the situation calculus, both of which 
require a strong technical background. 



3.7 Foundational Axioms for Situations 

There are four foundational axioms for the situation calculus, based on JPirri andReiter 19991 
but simpler that the ones presented there. They capture the intuition that situations are finite 
sequences of actions where the second order induction principle holds, and that there is a 
"subsequence" relation among them. In the following axioms, P is a predicate symbol. 

do{ai, si) = do{a2, S2) ^ ai — a2 /\ si — S2 (1) 

yP ■ P{So) A Va, s • [P(s) P{do{a, s))] ^ Vs • P{s) (2) 

Axiom[2is a unique name axiom for situations: two situations are the same iff they are the 
same sequence of actions. Axiom|2]is second order induction on situations. The third and 
fourth axioms are: 

- (5 C So) (3) 

(s C do{a, s')) = (s C s') (4) 

Here s C s' is an abbreviation for (s IZ s') V (s = s'). The relation C provides an ordering 
relation on situations. Intuitively, s □ s' means that the situation s' can be obtained from 
the situation s by adding one or more actions to the end of s. 

The above four axioms are domain independent. They provide the basic properties of 
situations in any domain specific axiomatization of particular fluents and actions. 



3.2 ConGolog 

ConGolog is a concurrent programming language based on the situation calculus which 
includes facilities for prioritizing the concurrent execution, interrupting the execution when 
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certain conditions become true, and dealing with exogenous actions. As stated by De Gia- 
como, Lesperance and Levesque in ( De Giacomo et al. 2000 1, the adoption of a language 
like ConGolog is a promising alternative to traditional plan synthesis, since it allows high- 
level program execution. ConGolog is an extension of the programming language Golog 
( P^evesque et al. 1997^ : in Section 13.2.11 we present Golog and in Section 13.2.21 we deal 
with its extension GonGolog. 

3.2.1 Golog 

Golog is a logic -programming language whose primitive actions are drawn from a back- 
ground domain theory. 

Golog programs are inductively defined as: 

• Given a situation calculus action a with all situation arguments in its parameters 
replaced by the special constant now, a is a Golog program (primitive action). 

• Given a situation calculus formula ip with all situation arguments in its parameters 
replaced by the special constant now, (p? is a Golog program (wait for a condition). 

• Given S, Si, S2, 6n Golog programs, 

— (i^i; S2) is a Golog program (sequence); 

— (^1 I ^2) is a Golog program (nondeterministic choice between actions); 

— TTv ■ 6 is a Golog program (nondeterministic choice of arguments); 

— (5* is a Golog program (nondeterministic iteration); 

— {proc Pi{vi)5i end; . . . proc Pn{vn)Sn end; (5 } is a Golog program (proce- 
dure: Pi are procedure names and Vi are their parameters). 

Program Execution. Given a domain theory V and a program d the execution task is to 
find a sequence a of actions such that: 

Doi6,So,doia,So)) 

where 

Do{6,s,s') 

means that program S when executed starting in situation s has s' as a legal terminating 
situation, and 

do{ a, s) ~ do{[ai, . . . , a„], s) 

is an abbreviation for 

rfo(a„, do(a„_i, . . . , do{ai,s))). 
Since Golog programs can be nondeterministic, there may be several terminating situations 
for the same program and starting situation. Do{S, s, s') is formally defined by means of 
the following inductive definition: 

1. Primitive actions (a[s] denotes the action obtained by substituting the situation vari- 
able s for all occurrences of now in functional fluents appearing in a): 

Do{a, s, s') =^ Poss{a[s], s) A s' = do{a[s], s) 
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2. Wait/test actions (tf[s\ denotes the formula obtained by substituting the situation 
variable s for all occurrences of now in functional and predicate fluents appearing 
in tp): 

Do{ip7, s, s') =^ if[s] As^s' 

3. Sequence: 

Doi6i;S2, s, s') '^^ 3s" ■ Do{5i, s, s") A Do{62, s" , s') 

4. Nondeterministic branch: 

Do{5i I 52, s, s') =^ Do{6i, s, s') V Do{62, s, s') 

5. Nondeterministic choice of argument (ttx ■ 5{x) is executed by nondeterministically 
picking an individual x, and for that x, performing the program 6{x)): 

Do{iTX ■ 5{x), s, s') 3x ■ Do{6{x), s, s') 

6. Nondeterministic iteration: 

Doid*, S, S') =^ yP ■ {VSI • P(S1, Si) A VSI, 52, 53 • [P{S1, S2) A Do{d, S2, S3) 
^P{S,,S3)]}^P{S,S') 

P is a binary predicate symbol. Saying "(x, x') is in the set (defined by P)" is equiv- 
alent to saying "P{x, x') is true". Doing action 5 zero or more times leads from the 
situation s to the situation s' if and only if (s, s') is in every set (and therefore, the 
smallest set) such that: 

(a) (si, si) is in the set for all situations si. 

(b) Whenever (si, S2) is in the set, and doing 5 in situation S2 leads to situation 
S3, then (si, S3) is in the set. 

The above is the standard second order definition of the set obtained by nondeter- 
ministic iteration. 

We do not deal with expansion of procedures. The reader can see ( |Levesque et al. 1997^ 
for the details. 

3.2.2 ConGolog 

ConGolog is an extended version of Golog that incorporates concurrency, handling: 

• concurrent processes with possibly different priorities; 

• high-level interrupts and 

• arbitrary exogenous actions. 

ConGolog programs are defined by the following inductive rules: 

• All Golog programs are GonGolog programs. 

• Given a situation calculus formula (p with all situation arguments in its parameters 
replaced by the special constant now, and 6, 61, 62 ConGolog programs. 
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— if then Si else S2 is a ConGolog program (synchronized conditional); 

— while Lp7 do (5 is a ConGolog program (synchronized loop); 

— {^1 II '^2) is a ConGolog program (concurrent execution); 

— ((5i))(52) is a ConGolog program (concurrency with different priorities); 

— (jll is a ConGolog program (concurrent iteration); 

— <ip S> is a ConGolog program (interrupt). 

The constructs if (p then Si else 62 and while cp? do S are the synchronized versions of 
the usual if-then-else and while-loop. They are synchronized in the sense that the test of the 
condition cp does not involve a transition per se: the evaluation of the condition and the first 
action of the branch chosen will be executed as an atomic action. The construct {Si \\ S2) 
denotes the concurrent execution of the actions Si and S2- {Si))S2) denotes the concurrent 
execution of the actions Si and S2 with Si having higher priority than S2, restricting the 
possible interleavings of the two processes: S2 executes only when Si is either done or 
blocked. The construct (j" is like nondeterministic iteration, but where the instances of S 
are executed concurrently rather than in sequence. Finally, {p S) is an interrupt. It has 
two parts: a trigger condition ip and a body S. The idea is that the body S will execute 
some number of times. If p never becomes true, S will not execute at all. If the interrupt 
gets control from higher priority processes when p is true, then S will execute. Once it has 
completed its execution, the interrupt is ready to be triggered again. This means that a high 
priority interrupt can take complete control of the execution. 

3.2.3 Semantics 

The semantics of Golog and ConGolog is in the style of transition semantics. Two pred- 
icates are defined which say when a program S can legally terminate in a certain situation 
s {Final{S, s)) and when a program S in the situation s can legally execute one step, end- 
ing in situation s' with program S' remaining (Trans{S, s, S', s')). Final and Trans are 
characterized by a set of equivalence axioms, each depending on the structure of the first 
argument. To give the flavor of how these axioms look like, we show the ones for empty 
program nil, atomic action a, testing pi, nondeterministic branch {Si \ S2) and concurrent 
execution {Si \\ S2)^- The reader can find the complete set of axioms for Final and Trans 
in JDe Giacomo et al. 2000> . 

Trans {nil, s, 5' , s') = false 

Trans{a, s,S' , s') = Foss{a[s], s) /\ S' — nil /\ s' do{a[s], s) 

Trans{p7, s, S' , s') = p[s] A S' = nil A s' ~ s 

Trans{Si \ S2, s, S' , s') = Trans{Si, s, S' , s') V Trans{S2, s, S' , s') 
Trans{Si \\ S2,s,S',s') = 

3j ■ S' — (7 II ^2) A Trans{Si, s, 7, s')V 

37 • (5' = {Si II 7) A Trans{S2, s, 7, s') 



^ In order to define axioms properly, programs should be encoded as first order terms. We avoid dealing with this 
encoding, and describe axioms as if programs were already first order terms. 
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The meaning of these axioms is that: {nil, s) does not evolve to any configuration; (a, s) 
evolves to {nil, do{a[s\, s)) provided that a[s\ is possible in s; [ipl , s) evolves to [nil, s) 
provided that (p[s] holds; {6i \ 62, s) can evolve to {S' , s') provided that either {Si, s) or 
{62, s) can do so; and finally, {61 \\ S2, s) can evolve if {61, s) can evolve and 62 remains 
unchanged or {62, s) can evolve and Si remains unchanged. 

Final{nil, s) = true 

Final{a,s) = false 

Final{(p7, s) = false 

Final{Si \ S2, s) = Final{Si, s) V Final{S2, s) 

Final{Si \\ 62, s) = Final{5i, s) A Final{S2, s) 

These axioms say that {nil, s) is a final configuration while neither {a, s) nor {ipl, s) are. 
{61 I 62, s) is final if either {Si, s) is or {S2, s) is, while {61 \\ 62, s) is final if both {61, s) 
and {62, s) are. 

The possible configurations that can be reached by a program 5 in situation s are those 
obtained by repeatedly following the transition relation denoted by Trans starting from 
{6, s). The reflexive transitive closure of Trans is denoted by Trans*. By means of Final 
and Trans* it is possible to give a new definition of Do as 

Do{S, s, s') "^^ 3S' ■ Trans* {5, s, S' , s') A Final {S' , s') 

3.2.4 Implementation 

A simple implementation of ConGolog has been developed in Prolog. The definition 
of the interpreter is lifted directly from the definitions of Final, Trans and Do given 
above. The interpreter requires that the program's precondition axioms, successor state 
axioms and axioms about the initial situation be expressible as Prolog clauses. In par- 
ticular, the usual closed world assumption is made on the initial situation. Section 8 of 
JDe Giacomo et al. 2000'> describes the ConGolog interpreter in detail and proves its cor- 
rectness under suitable assumptions. The interpreter is included into a more sophisticated 
toolkit which provides facilities for debugging GonGolog programs and delivering process 
modeling applications by means of a graphical interface. Visit ( jCognitive Robotics Group Home Page 2002^ 
to download the interpreter of both ConGolog and its extensions discussed in the next sec- 
tion. 

3.2.5 Extensions 

Some variants of GonGolog have been developed in the last years: 

• Legolog {LEGO MINDSTORM in (Con )Golog ( |Levesque and Pagnucco 2000| i) uses 
a controller from the Golog family of planners to control a MINDSTORM robot. 
Legolog is capable of dealing with primitive actions, exogenous actions and sensing; 
the Golog controller is replaced with an alternate planner Visit ( [Legolog Home Page 2000^ 
for details. 
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• IndiGolog (Incremental Deterministic (Con)Golog JDe Giacomo et al. 2002t ') is a 
high-level programming language where programs are executed incrementally to 
allow for interleaved action, planning, sensing, and exogenous events. IndiGolog 
provides a practical framework for real robots that must react to the environment and 
continuously gather new information from it. To account for planning, IndiGolog 
provides a local lookahead mechanism with a new language construct called the 
search operator. 

• GASL (Cognitive Agent Specification Language fShapiro et al. 2002^) is a frame- 
work for specifying complex MASs which also provides a verification environment 
based on the PVS verification system JOwre et al. 1996> . 

• A class of knowledge-based Golog programs is extended with sense actions in 
l lReiter2001> . 

Most of the publications on Golog, GonGolog and their extensions can be found at 
( [Cognitive Robotics Group Home Page 2002^ . 

3.2.6 Example 

The program for the seller agent, written in ConGolog, could look as follows. The em- 
phasized text is used for constructs of the language; the normal text is used for comments. 
Lowercase symbols represent constants of the language and uppercase symbols are vari- 
ables. Predicate and function symbols are lowercase (thus, the Poss predicate symbol in- 
troduced in the beginning of Section|3]is written poss in the example). These Prolog-like 
conventions will be respected in all the examples appearing in the paper, unless stated 
otherwise. 

• Primitive actions declaration: 

ship(Buyer, Merchandise, Required-amount) 

The seller agent delivers the Required- amount of Merchandise to the Buyer. 
send(Sender, Receiver, Message) 
Sender sends Message to Receiver. 

• Situation independent functions declaration: 

min-price(Merchandise) = Min 

The minimum price the seller is willing to take under consideration for Mer- 
chandise is Min. 
max-price(Merchandise) = Max 

The price for Merchandise that the seller accepts without negotiation is equal 
or greater than Max. 

• Primitive fluents declaration: 

receiving(Sender, Receiver, Message, S) 

Receiver receives Message from Sender in situation S. 

storing(Merchandise, Amount, S) 

The seller stores Amount of Merchandise in situation S. 
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• Initial situation axioms: 

min-price(orange) = 1 
max-price(orange) = 2 
V S, R, M. receiving(S, R, M, sq) 
stonng(orange, 1000, sq) 

• Precondition axioms: 

poss(ship(Buyer, Merchandise, Required- amount), S) = 

storing(Merchandise, Amount, S) A Amount > Required- amount 
It is possible to ship merchandise iff there is enough merchandise stored in the 
warehouse. 

poss(send(Sender, Receiver, Message), S) = true 
It is always possible to send messages. 

• Successor state axioms: 

receiving(Sender, Receiver, Message, 

do(send(Sender, Receiver, Message), S)) = true 
Receiver receives Message from Sender in do(send(Sender, Receiver, Mes- 
sage), S) reached by executing send(Sender, Receiver, Message) in S. For sake 
of conciseness we opted for a very simple formalization of agent communi- 
cation. More sophisticated formalizations can be found in JMarcu et al. 1995t 
and ( S hapiro et al. 1998. ). 
storing(Merchandise, Amount, do(A, S)) = 

(A = ship(Buyer, Merchandise, Required- amount) A 
storing(Merchandise, Required-amount -h Amount, S)) 
y (Ay^ ship(Buyer, Merchandise, Required- amount) A 
storing(Merchandise, Amount, S)) 
The seller has a certain Amount of Merchandise if it had Required- amount 
+ Amount of Merchandise in the previous situation and it shipped Required- 
amount of Merchandise, or if it had Amount of Merchandise in the previous 
situation and it did not ship any Merchandise. 

We may think that a buyer agent executes a buyer-life-cycle procedure concurrently with 
the seller agent procedure seller-life-cycle, buyer-life-cycle defines the actions the buyer 
agent takes according to its internal state and the messages it receives. The seller-life-cycle 
is defined in the following way. 



proc seller-life-cycle 



while true do 

if receiving(Buyer, seller, contractProposal(Merchandise, Required-amount, Price), 

now) 

then 

if storing(Merchandise, Amount, now) 
A Amount > Required-amount 
A Price > max-price(Merchandise) 
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then ship(Buyer, Merchandise, Required-amount) 

II send(seUer, Buyer, accept(Merchandise, Required-amount, Price)) 

else 

if (storing(Merchandise, Amount, now) 
A Amount < Required- amount) 
V Price < min-price(Merchandise) 

then send(seller, Buyer, refuse(Merchandise, Required-amount, Price)) 
else 

if storing(Merchandise, Amount, now) 
A Amount > Required- amount 

A min-price(Merchandise) < Price < max-price(Merchandise) 
then send(seller, Buyer, 

con trac tProposal(Merchandise, Req uired-am ount, 
(Price-i-max-price(Merchandise ))/2)) 
else nil 

else nil 



4 Modal Logic 

This introduction is based on (IFisher and Owens 1995> . Modal logic is an extension of 
classical logic with (generally) a new connective □ and its derivable counterpart 0, known 
as necessity and possibility respectively. If a formula Op is true, it means that p is neces- 
sarily true, i.e. true in every possible scenario, and ()p means that p is possibly true, i.e. 
true in at least one possible scenario. It is possible to define in terms of □: 

Op ^ -.n^p 

so that p is possible exactly when its negation is not necessarily true. In order to give 
meaning to □ and 0, models for modal logic are usually based on possible worlds, which 
are essentially a collection of connected models for classical logic. The possible worlds 
are linked by a relation which determines which worlds are accessible from any given 
world. It is this accessibility relation which determines the nature of the modal logic. Each 
world is given a unique label, taken from a set S, which is usually countably infinite. The 
accessibility relation R is a binary relation on S. The pairing of S and R defines a frame 
or structure which underpins the model of modal logic. To complete the model we add an 
interpretation 

h: S X PROP -> {true, false} 

of propositional formulae G PROP in each state. 
Given s e S and a e PROP, 

{S,R,h) \=s a iff /i(s, a) = true 

This is read as: a is true in world s in the model (5*, R, h) iff h maps a to true in world s. 
In general when a formula ip is true in a world s in a model A^, it is denoted by 
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and if it is true in every world in the set 5, it is said to be true in the model, and denoted by 

The boolean connectives are given the usual meaning: 

(5, i?, /i) V V iff {S,R,h)^s^ ox {S,R,h)\=s^ 

{S, R,h) ^s^^i' iff {S, R, h) V implies (5', R, h) ^ 

The frame enters the semantic definition only when the modality □ is used, as the formula 
□ (^ is true in a world s exactly when every world t in S which is accessible from s (i.e. 
such that s R t) has Lp true. More formally, 

{S, R, h) Ulp iff for all f e 5, s Rt implies {S, R, h) V> 

The models (5*, i?, h) and the semantics we introduced for connectives are also known as 
Kripke models (or structures) and Kripke semantics, respectively ( |Kripke 1963b||Kripke 1963a| 
[Kripke 1965^ , from the name of the author who mainly contributed to developing a satis- 
factory semantic theory of modal logic. 

4.1 AGENT-0 

Shoham's paper Agent-Oriented Programming JShoham 19931 1 is one of the most cited 
papers in the agent community, since it proposed a new programming paradigm that 

promotes a societal view of computation, in which muhiple "agents" interact with one another. 

In this section we first introduce the basic concepts of the agent-oriented programming 
(AOP) paradigm, and then we present the AGENT-0 programming language. This is often 
referred to as the first agent programming language, even though 

the simphfications embodied in AGENT-0 are so extreme that it may be tempting to dismiss it as 
uninteresting tShoham 1993t . 

We opted for describing AGENT-0 as the language representing the class of languages 
based on mental modalities because it was the first one to adopt this approach. Other agent 
programming languages including mental modalities are 3APL JHindriks et al. 1998J and 
AgentSpeak(L) JRao 1996t which will be discussed in SectionfTol 

For Shoham, a complete AOP system will include three primary components: 

1 . A restricted formal language with clear syntax and semantics for describing mental 
states; the mental state will be defined uniquely by several modalities, such as belief 
and commitments. 

2. An interpreted programming language in which to define and program agents, with 
primitive commands such as REQUEST and INFORM. 

3. An "agentification process" to treat existing hardware devices or software apphca- 
tions like agents. 

The focus of Shoham's work is on the second component. 

The mental categories upon which the AOP is based are belief and obligation (or com- 
mitment). A third category, which is not a mental construct, is capability. Decision (or 
choice) is treated as obligation to oneself. 
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Since time is basic to the mental categories, it is necessary to specify it. A simple point- 
based temporal language is used to talk about time; a typical sentence will be 

holding {robot, cupY 

meaning that the robot is holding the cup at time t. 

As far as actions are concerned, they are not distinguished from facts: the occurrence of 
an action is represented by the corresponding fact being true. 

Beliefs are represented by means of the modal operator B. The general form of a belief 
statement is 

meaning that agent a beUeves </? at time 1. may be a sentence like holding {robot, cup)* 
or a belief statement: nested belief statements like B^Bl'^like{a, by, meaning that at time 
3 agent a believes that at time 10 agent b will believe that at time 7 a liked b, are perfectly 
legal in the AOP language. 

The fact that at time t an agent a commits himself to agent b about is represented by 
the sentence 

OBLl,^ 

A decision is an obligation to oneself, thus 

DEClf =^ OBLlj 
The fact that at time t agent a is capable of ip is represented by 

Finally, there is an "immediate" version of CAN: 

ABLEaf = CAN^'^^'^^ip 
where tim.e{Bl^^) = t and time{pred{arg\, ■ ■ ■, argnY) = t). 

To allow the modalities introduced so far resemble their common sense counterparts, 
some assumptions are made: 

• Internal consistency: both the beliefs and the obligations are assumed to be internally 
consistent. 

• Good faith: agents commit only to what they believe themselves capable of, and only 
if they really mean it. 

• Introspection: agents are aware of their obligations. 

• Persistence of mental state: agents have perfect memory of, and faith in, their beUefs, 
and only let go off a belief if they learn a contradictory fact. Obligations too should 
persist, and capabilities too tend not to fluctuate wildly. 

AGENT-0 is a simple programming language that implements some of the AOP con- 
cepts described above. Since AGENT-0 allows to define one program for each agent in- 
volved in the system, it is no longer necessary to explicitly say which agent is performing 
which action; as an example, the statement B^ip becomes {B{t{(p))) in the body of code 
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associated with agent a. In AGENT-0 the programmer specifies only conditions for mak- 
ing commitments; commitments are actually made and later carried out, automatically at 
the appropriate times. Commitments are only to primitive actions, those that the agent can 
directly execute. Before defining the syntax of commitments, other basic definitions are 

necessary. 

Facts. Fact statements constitute a tiny fragment of the temporal language described in 
the previous paragraph: they are essentially the atomic objective sentences of the form 

(t atom) 

and 

(NOrr (t atom)) 

For example, (0 (stored orange 1000)) is an AGENT-0 fact stating that at time there 
where 1000 oranges in the warehouse. 
Private actions. The syntax for private actions is 

(DO t p-action) 

where t is a time point and p-action is a private action name. The effects of private ac- 
tions may or may not be visible to other agents. 
Communicative actions. There are three types of communicative actions: 

(INFORM t a fact) 

where t is the time point in which informing takes place, a is the receiver's name and 
fact is a fact statement. 

(REQUEST t a action) 
where t is a time point, a is the receiver's name and action is an action statement. 

(UNREQUEST t a action) 
where t is a time point, a is the receiver's name and action is an action statement. 
Nonaction. A "nonaction" prevents an agent from committing to a particular action. 

(REFRAIN action) 

Mental conditions. A mental condition is a logical combination of mental patterns which 
may assume two forms: 

(B fact) 

meaning that the agent believes B or 

((CMT a) action) 

where CMT stands for commitment. The information about time is included in facts and 
actions; an example of a mental pattern is (B (3 (stored orange 950))) meaning that the 
agent believes that at time 3 there were 950 oranges left in the warehouse. 

Capabilities. The syntax of a capability is 

(action mentalcondition) 
meaning that the agent is able to perform action provided that mentalcondition (see 
above) is true. Throughout the example we will use this syntax which is inherited from 
the original paper, even if a notation including the CAN keyword (namely, (CAN action 
mentalcondition)) would be more appropriate. 

Conditional action. The syntax of a conditional action is 

(IF mentalcondition action) 
meaning that action can be performed only if mentalcondition holds. 

Message condition. A message condition is a logical combination of message patterns, 
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which are triples 

(From Type Content) 

where From is the sender's name. Type is INFORM, REQUEST or UNREQUEST and 
Content is a fact statement or an action statement. 

Commitment rule. A commitment rule has the form: 

(COMMIT messagecondition mentalcondition (agent action)*) 
where messagecondition and mentalcondition are respectively message and mental con- 
ditions, agent is an agent name, action is an action statement and * denotes repetition 
of zero or more times. The intuition behind the commitment rule (COMMIT msgcond 
mntcond (agi acti) ... (agn actn)) in the program defining the behavior of agent ag is 
that if ag receives a message satisfying msgcond and its mental states verifies the con- 
dition mntcond, it commits to agent agi about acti, and to agent agn about actn- 
Note that commitment rules are identified by the COMMIT keyword and commitment 
mental pattern (see the definition of mental conditions above) are identified by the CMT 
keyword. We adopt this syntax to be consistent with the original paper even if we are 
aware that using similar keywords for different syntactic objects may be confusing. 

Program. A program is defined by the time unit, called "timegrain", followed by the ca- 
pabilities, the initial beliefs and the commitment rules of an agent. Timegrain ranges 
over m (minute), h (hour), d (day) and y (year). 

4.7.7 Semantics 
No formal semantics for the language is given. 

4.1.2 Implementation 

A prototype AGENT-0 interpreter has been implemented in Common Lisp and has been 
installed on Sun/Unix, DecStation/Ultrix and Macintosh computers. Both the interpreter 
and the programming manual are available to the scientific community. A separate imple- 
mentation has been developed by Hewlett Packard as part of a joint project to incorporate 
AOP in the New Wave™ architecture. 

The AGENT-0 engine is characterized by the following two-step cycle: 

1. Read the current messages and update beliefs and commitments. 

2. Execute the commitments for the current time, possibly resulting in further belief 
change. 

Actions to which agents can be committed include communicative ones such as informing 
and requesting, as well as arbitrary private actions. 

4.1.3 Extensions 

Two extensions of AGENT-0 have been proposed: 

• PLAGA JThomas 1995t enriches AGENT-0 with a mechanism for flexible manage- 
ment of plans. It adds two data structures to the agent's state: a list of intentions 
and a list of plans. Intentions are adopted is a similar way that commitments are; 



Logic-Based Specification Languages for Intelligent Software Agents 19 



the PL AC A command (ADOPT (INTEND x)) means that the agent will add the in- 
tention to do X to its intention list. Plans are created by an external plan generator 
to meet these intentions. This approach gives the system the ability to dynamically 
alter plans that are not succeeding. 
• Agent-K (j Pavies and Edwards 19941 is an attempt to standardize the message pass- 
ing functionality in AGENT-0. It combines the syntax of AG ENT-0 (without support 
for the planning mechanisms of PLAGA) with the format of KQML (Knowledge 
Query and Manipulation Language f Mayheld et al. 1995^) to ensure that messages 
written in languages different from AGENT-0 can be handled. Agent-K introduces 
two major changes to the structure of AGENT-0: first, it replaces outgoing iNFOi?M, 
REQUEST, and UNREQUEST message actions with one command, KQML, that 
takes as its parameters the message, the time, and the KQML type; second, it allows 
many commitments to match a single message. In AGENT-0 the multiple commit- 
ment mechanism was not defined and the interpreter simply selected the first rule 
that matched a message. 

4.1.4 Example 

The AGENT-0 program for the seller agent may be as follows. Variables are preceded by 
a "?" mark instead of being uppercase, coherently with the language syntax. Universally 
quantified variables, whose scope is the entire formula, are denoted by the prefix "?!". 

timegrain := m 

The program is characterized by a time-grain of one minute. 

CARABILITIES := ((DO ?time (ship ?!buyer ?merchandise ?required-amount ?!price)) 
(AND (B (?time (stored ?merchandise ?stored-amount))) 
(> ?stored-amount ?required-amount))) 

The agent has the capability of shipping a certain amount of merchandise, provided that, 
at the time of shipping, it believes that such amount is stored in the warehouse. 

mrriAL beliefs -.= (O (stored orange 1000)) 
(?!time (min-price orange 1)) 
(?!time (max-price orange 2)) 

The agent has initial beliefs about the minimum price, maximum price and stored amount 
of oranges. The initial belief about stored oranges only holds at time 0, since this amount 
will change during the agent's life, while beliefs about minimum and maximum prices hold 
whatever the time. 
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COMMITMENT RULES := (COMMIT 
(?buyer REQUEST 

(DO now (ship ?buyer ?merchandise ?req-anmt ?pnce))) 

(AND (B (now (stored ?merchandise ?stored-amount))) 
(> ?stored-amount ?req-anmt) 
(B (now (max-price ?merchandise ?max))) 
(> ?pnce ?max)) 

(?buyer (DO now 

(ship ?buyer ?merchandise ?req-amnt ?price))) 
(myself (INFORM now ?buyer 

(accepted ?merchandise ?req-anmt ?price))) 
(myself (DO now (update-merchandise ?merchandise ?req-amnt))) 
) 

The first commitment rule says that if the seller agent receives a request of shipping a 
certain amount of merchandise at a certain price, and if it believes that the required amount 
is stored in the warehouse and the proposed price is greater than max-price, the seller agent 
commits itself to the buyer to ship the merchandise (ship is a private action), and decides 
(namely, commits to itself) to inform the buyer that its request has been accepted and to 
update the stored amount of merchandise (update-merchandise is a private action). 



(COMMIT 
(?buyer REQUEST 

(DO now (ship ?buyer ?merchandise ?req-amnt ?price))) 

(OR (AND (B (now (stored ?merchandise ?stored-amount))) 
(< ?stored-amount ?req-amnt)) 
(AND (B (now (min-price ?merchandise ?min))) 
(< ?price ?min))) 

(myself (INFORM now Tbuyer 

(refused ?merchandise ?req-amnt ?price))) 

) 

The second rule says that if the required amount of merchandise is not present in the ware- 
house or the price is too low, the seller agent decides to inform the buyer that its request 
has been refused. 



(COMMIT 
(?buyer REQUEST 

(DO now (ship ?buyer ?merchandise ?req-amnt ?price))) 
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(AND (B (now (stored ?merchandise ?stored-amount))) 
(> ?stored-amount ?req-amnt) 
(B (now (max-price ?merchandise ?max))) 
(< ?price ?max) 

(B (now (min-price ?merchandise ?min))) 
(> ?price ?min)) 

(myself (DO now (eval-mean ?max ?pnce ?mean-price))) 
(myself (REQUEST now ?buyer 

(eval-counter-proposal ?merchandise ?req-amnt ?mean-price))) 

) 

Finally, the third rule says that if the price can be negotiated and there is enough mer- 
chandise in the warehouse, the seller agent evaluates the price to propose to the buyer 
agent [eval-mean is a private action) and decides to send a counter-proposal to it. We are 
assuming that the buyer agent is able to perform an eval-counter-proposal action to eval- 
uate the seller agent's proposal: the seller agent must know the exact action syntax if it 
wants that the buyer agent understands and satisfies its request. 

5 Deontic Logic 

This introduction is based on the book Deontic logic in Computer Science ( |Meyer and Wieringa 1993^ . 
Deontic logic is the logic to reason about ideal and actual behavior. From the 1950s, von 

Wright l |von Wright 195 It , Castaneda JCastaneda 1975> . Alchourronand Bulygin l |Alchourr6n and Bulygin 1971) 
and others developed deontic logic as a modal logic with operators for permission, obliga- 
tion and prohibition. Other operators are possible, such as formalizations of the system of 
concepts introduced by Hohfeld in 1913, containing operators for duty, right, power, liabil- 
ity, etc JHohfeld 1913t . Deontic logic has traditionally been used to analyze the structure 
of normative law and normative reasoning in law. Recently it has been realized that deontic 
logic can be of use outside the area of legal analysis and legal automation: it has a potential 
use in any area where we want to reason about ideal as well as actual behavior of systems. 
To give an idea of what deontic logic systems look like, we describe the OS Old System 
l |von Wright 195 It and the KD Standard System of Deontic Logic ( |Aqvist 1984| l. 

5.7 The OS System 

The OS system is based on two deontic operators: O, meaning obligation, and P meaning 
permission. Let p be a proposition in the propositional calculus, then Op and Pp are 
formulae in the OS deontic logic language. 

The system consists of the following axioms and inference rule: 

(050) All tautologies of Propositional Calculus 

(051) Op = -^P^p 

(052) PpVP-p 
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(OS3) P(?3 V g) = Pp VPg 

Axiom (OSl) expresses that having an obligation to p is equivalent to not being permitted 
to not p; (OS2) states that either p is permitted or not p is; (OSS) says that a permission 
to p or 5 is equivalent to p being permitted or q being permitted; (OS4) asserts that if 
two assertions are equivalent, then permission for one implies permission for the other, 
and vice versa. Later, it was realized that the system OS is very close to a normal modal 
logic, enabling a clear Kripke-style semantics using O as the basic necessity operator, at 
the expense of introducing the validity of 

(OT) 0{p\/^p) 

stating the existence of an empty normative system, which von Wright rejected as an ax- 
iom. 



5.2 The KD System 

The KD System is a von Wright-type system including the F (forbidden) operator and 
consisting of the following axioms and rules. 

(KDO) All tautologies of Prepositional Calculus 
(KDl) 0(p ^ g) ^ (Op ^ Og) 
(KD2) Op ^ Pp 
(KD3) Pp = -^O^p 
(KD4) Fp = -^Pp 

(KD5) Modus ponens: ^ 

(KD6) O-necessitation: ^ 

Axiom (KDl) is the so called K-axiom; (KD2) is the D-axiom, stating that obligatory im- 
plies permitted; (KD3) states that permission is the dual of obligation and (KD4) says that 
forbidden is not permitted. (KDl) holds for any modal necessity operator. Essentially, it 
states that obligation is closed under implication. Whether this is desirable may be debat- 
able, but it is a necessary consequence of the modal approach. Note furthermore that the 
O-necessitation rule (KD6), which is also part of the idea of viewing deontic logic as a 
normal modal logic, impUes the axiom rejected by von Wright 

(OT) O(pV^p) 

So, if we want to view deontic logic as a branch of Kripke-style modal logic, we have to 
commit ourselves to (OT). 

As with other modal logics, the semantics of the standard system is based on the notion 
of a possible world. Given a Kripke model {S, R, h) and a world s € S we give the 
following semantics to the modal operators: 

{S, R, h) Op iff for all teS, s Rt implies {S, R, h) P 
{S, R, h) \=s Pp iff exists t G S such that s Rt A {S,R, h) \=t p 
{S, R, h) ¥p iff for dX\. teS, s Rt implies (5, R, h) p 
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As already stated, the operator O is treated as the basic modal operator □: for Op being 
true in world s we have to check whether p holds in all the worlds reachable from s, as 
given by the relation R. This reflects the idea that something is obligated if it holds in all 
perfect (ideal) worlds (relative to the world where one is). This semantics is exactly the 
same semantics of □, as defined in Section|4] The other operators are more or less derived 
from O. The operator P is the dual of O: Vp is true in the world s if there is some world 
reachable from s where p holds. Finally, something is forbidden in a world s if it does not 
hold in any world reachable from s. 



5.3 The IMPACT Agent Language 

We introduce the I M PACT agent programming language JArisha et al. 1999UEiter et al. 19991 
lEiter and Subrahmanian 19991 lEiter et al. 2 000 1 as a relevant example of use of deontic 
logic to specify agents. In order to describe this language, we provide a set of definitions 
on top of which the language is based. 

Agent Data Structures. All IMPACT agents are built "on top" of some existing body of 
code specified by the data types or data structures, T, that the agent manipulates and by 
a set of functions, JT, that are callable by external programs. Such functions constitute the 
application programmer interface or API of the package on top of which the agent is being 
built. 

Based on T and T supported by a package (a body of software code) C, we may use a 
unified language to query the data structures. If f e is an n-ary function defined in that 
package, and ti, . . . , tn are terms of appropriate types, then C : f (ti, . . . , tn) is a code 
calL This code call says "Execute function f as defined in package C on the stated list of 
arguments." 

A code call atom is an expression cca of the form in(t, cc) or notin(t, cc), where t 
is a term and cc is a code call. in(t, cc) evaluates to true (resp. false) in a given state if t 
is (resp. is not) among the values returned by calling cc in that state. The converse holds 
for notin(t, cc). For example, 

in((lnOut, Sender, Receiver, Message, Time), msgbox : getMessage(Sender)) 
is true in a given state if the term (inDut, Sender, Receiver, Message, Time) is among 
the values returned by calling the getMessage(Sender) function provided by the msgbox 
package in that state. 

A code call condition is a conjunction of code call atoms and constraint atoms of the 
form ti op t2 where op is any of =, 7^, <,<,>, > and ti, t2 are terms. 

Each agent is also assumed to have access to a message box package identified by 
msgbox, together with some API function calls to access it (such as the getMessage func- 
tion appearing in the code call atom above). Details of the message box in IMPACT may 
be found in JEiter et al. 1999^ . 

At any given point in time, the actual set of objects in the data structures (and message 
box) managed by the agent constitutes the state of the agent. We shall identify a state O 
with the set of ground (namely, containing no variables) code calls which are true in it. 
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Actions. The agent can execute a set of actions a{Xi , . . . , X„). Such actions may include 
reading a message from the message box, responding to a message, executing a request, 
updating the agent data structures, etc. Even doing nothing may be an action. Expressions 
a{t), where ?is a list of terms of appropriate types, are action atoms. Every action a has 
a precondition Pre (a) (which is a code call condition), a set of effects (given by an add 
list Add{a) and a delete list Del{a) of code call atoms) that describe how the agent state 
changes when the action is executed, and an execution script or metliod consisting of a 
body of physical code that implements the action. 

Notion of Concurrency. The agent has an associated body of code implementing a notion 
of concurrency conc{ AS , O). Intuitively, it takes a set of actions AS and the current agent 
state O as input, and returns a single action (which "combines" the input actions together) 
as output. Various possible notions of concurrency are described in (Ei ter et al. 1999> . For 
example, weak concurrent execution is defined as follows. Let AS he the set of actions in 
the current status set, evaluated according to the chosen semantics. Weakly concurrently 
executing actions in ^45 means that first all the deletions in the delete list of actions in ^5" 
are done in parallel and then all the insertions in the add list of actions in ^5* are. Even 
if some problems arise with this kind of concurrency, it has the advantage that deciding 
whether a set of actions is weakly-concurrent executable is polynomial (Theorem 3.1 of 
(Eiter et al. 1999 1). 

Integrity Constraints. Each agent has a finite set 2C of integrity constraints that the state 
O of the agent must satisfy (written O ^ TC), of the form "0 => Xa where is a code 
call condition, and Xa is a code call atom or constraint atom. Informally, ip ^ Xa has the 
meaning of the universal statement "If ip is true, then Xa must be true." For simplicity, we 
omit here and in other places safety aspects (see (lEiter et al. 1999> for details). 

Agent Program. Each agent has a set of rules called the agent program specifying the 
principles under which the agent is operating. These rules specify, using deontic modalities, 
what the agent may do, must do, may not do, etc. Expressions Oa{t), Pa{t), Fa{t), 
Do a{t), and 'Wa{t), where a{t) is an action atom, are called action status atoms. These 
action status atoms are read (respectively) as a(t) is obligatory, permitted, forbidden, done, 
and the obligation to do a(t) is waived. If A is an action status atom, then A and ^A are 
called action status literals. An agent program "P is a finite set of rules of the form: 

yl ^ X & & • • • & in (5) 

where A is an action status atom, x is a code call condition, and Li , . . . , L„ are action 
status literals. 

5.5.7 Semantics 

If an agent's behavior is defined by a program V, the question that the agent must answer, 
over and over again is: 

What is the set of all action status atoms of the form Do q(<) that are true with respect to V, the 
current state O and the setXC of underlying integrity constraints on agent states? 
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This set defines the actions the agent must take; fEiter et al. 1999 1 provides a series of 
successively more refined semantics for action programs that answer this question, that we 
discuss in a very succinct form. 

Definition 1 (Status Set) A status set is any set S of ground action status atoms over the 
values from the type domains of a software package C. 

Definition 2 (Operator Appp o{S)) Given a status set S, the operator Appp c'(S') com- 
putes all action status atoms that may be inferred to be true by allowing the rules in V 
to fire exactly once. It is defined in the following way: let V be an agent program and O 
be an agent state. Then, Appp ^(5) = {Head{r9) \ r e P, R{r, 9, S) is true on O}, 
where Head(A ^x&Li&---&L„) = A and the predicate R{r, 9, S) is true iff (1) 
r9 : A ^ x ^ Li k ■ ■ ■ k is a ground rule, (2) O h X. (3) if = Op{a) then 
Op{a) G S, and (4) if L, = -nOp{a) then Op{a) ^ S, for alH e {1, . . . , n}. 

Definitions (A-C^^*)) A status set 5* is deontically closed, if for every ground action 
a, it is the case that (DCl) Oa G S impUes Pa € S. A status set 5" is action closed, 
if for every ground action a, it is the case that (ACl) Oa G S implies Do a G S, and 
{AC2) Do a G 5* implies Pa G S. It is easy to notice that status sets that are action closed 
are also deontically closed. For any status set S, we denote by A-Cl(S') the smallest set 
S' D S such that S' is closed under (ACl) and {AC2), i.e., action closed. 

Definition 4 (Feasible Status Set) Let V be an agent program and let O be an agent state. 
Then, a status set S* is a feasible status set for P on O, if (5'1)-(S'4) hold: 

{SI) Appp,o(5)C5; 

(52) For any ground action a, the following holds: Oa G S implies Wa ^ S, and 

Pa G 5 implies Fa ^ S. 
{S3) S = A-C1(5), i.e., S is action closed; 

(54) The state O' = conc(Do (5), O) which results from O after executing (according 
to some execution strategy cone) the actions in {a | Do (a) G 5} satisfies the integrity 
constraints, i.e., C 1= TC. 

Definition 5 (Groundedness; Rational Status Set) A status set 5 is grounded, if no sta- 
tus set S' ^ S exists such that S' C S and 5' satisfies conditions (51)-(53) of a feasible 
status set. A status set 5 is a rational status set, if 5 is a feasible status set and 5 is grounded. 

Definition 6 (Reasonable Status Set) Let P be an agent program, let O be an agent state, 
and let 5 be a status set. 

1. If T' is positive, i.e., no negated action status atoms occur in it, then 5 is a reason- 
able status set for P on O, iff 5 is a rational status set for P on O. 

2. The reduct of P w.r.t. 5 and O, denoted by red^ {P, O), is the program which is ob- 
tained from the ground instances of the rules in P over O as follows. 

(a) Remove every rule r such that Op{a) G 5 for some -iOp(a) in the body of r; 

(b) remove all negative hterals -iOp(a) from the remaining rules. 
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Then 5 is a reasonable status set for V w.r.t. O, if it is a reasonable status set of the program 
red^{V, O) with respect to O. 

5.3.2 Implementation 

The implementation of the IMPACT agent program consists of two major parts, both im- 
plemented in Java: 

1. the IMPACT Agent Development Environment (lADE for short) which is used by 
the developer to build and compile agents, and 

2. the run-time part that allows the agent to autonomously update its reasonable status 
set and execute actions as its state changes. 

The lADE provides a network accessible interface through which an agent developer 
can specify the data types, functions, actions, integrity constraints, notion of concurrency 
and agent program associated with her/his agent; it also provides support for compilation 
and testing. 

The runtime execution module runs as a background applet and performs the following 
steps: (i) monitoring of the agent's message box, (ii) execution of the algorithm for updat- 
ing the reasonable status set and (iii) execution of the actions a such that Doa is in the 
updated reasonable status set. 

5.3.3 Extensions 

Many extensions to the I M PACT framework are discussed in the book JSubrahmanian et al. 2000> 
which analyses: 

• meta agent programs to reason about other agents based on the beliefs they hold; 

• temporal agent programs to specify temporal aspects of actions and states; 

• probabilistic agent programs to deal with uncertainty; and 

• secure agent programs to provide agents with security mechanisms. 

Agents able to recover from an integrity constraints violation and able to continue to pro- 
cess some requests while continuing to recover are discussed in CEiter et al. 2002V The in- 
tegration of planning algorithms in the I M PACT framework is discussed in CDix et al. 2003t . 

5.3.4 Example 

The IMPACT example appears to be more complicated than the other ones because we 
exemplify how it is possible to specify actions that require an access to external packages. 
These actions are defined in terms of their preconditions, add and delete list which in- 
volve the code call atoms that allow the real integration of external software. The ability 
of accessing real software makes IMPACT specifications more complex than the others 
we discuss in this paper but, clearly, also more powerful. We suppose that the IMPACT 
program for the seller agent accesses three software packages: 

• an oracle database where information on the stored amount of merchandise and its 
minimum and maximum price is maintained in a stored-merchandise relation; 
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a msgbox package that allows agents to exchange messages, as described in Section 
3 of JEiter et al~19 99 1: in particular, it provides the getMessage(Sender) function 
which allows all tuples coming from Sender to be read and deleted from the message 
box of the receiving agent; and 

a mathematical package math providing mathematical functions. 
Initial state: 

The stored^erchandise relation, with schema <name, amount, min, max>, 
initially contains the tuple <orange, 1000, 1, 2> 

Actions: 

— ship(Buyer, Merchandise, Req-amount) 

Pre(ship(Buyer, Merchandise, Req.amount)) = 
in(01d^amount, 

oracle:select(stored_merchandise.amount, name, =, Merchandise)) A 
in(Difference, math:subtract(0}d_amount, Req_amount)) A 
Difference > 

Add(ship(Buyer, Merchandise, Req_amount)) = 
in(Difference, 

oracle:select(storedjnerchandise.amount, name, =, Merchandise)) 

Del(ship(Buyer, Merchandise, Req_amount)) = 
in(01d^amount, 

oracle:select(stored-merchandise.amount, name, =, Merchandise)) 
In order for the agent to ship merchandise, there must be enough merchandise 
available: the precondition of the action is true if the difference Difference 
between the stored amount of merchandise, 01d_amount, and the required 
amount, Req_amount, is greater than or equal to zero. The effect of shipping 
is that the amount of available merchandise is updated by modifying the infor- 
mation in the stored_merchandise table: stored^erchandise.amounthecomes 
equal to Difference, shared among the three equalities defining precondition, 
add list and delete list. Add and Del denote the desired modifications to the 
database through code calls. There is also a procedure, that we omit, that real- 
izes this action. In practice this procedure would also issue an order to physi- 
cally ship the merchandise. 

— sendMessage(Sender, Receiver, Message) 

This action accesses the msgbox package putting a tuple in the agent message 
box. The msgbox package underlying this action is assumed to ensure that 
tuples put in the message box are delivered to the receiver agent. The precon- 
dition of this action is empty (it is always possible to send a message), the add 
and delete lists consist of the updates to the receiver's mailbox. 
The notion of concurrency we adopt is weak concurrent execution introduced 
in Section lSJl 
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Integrity constraints: 

in(Min, oracle:select(stored_merchandise.min, name, =, Merchandise)) A 
in(Max, oracle:select(stored-merchandise.max, name, =, Merchandise)) 
< Min < Max 

This integrity constraint says that the minimum price allowed for any mer- 
chandise must be greater than zero and lower than the maximum price. 

in(Amount, 

oracle:select(storedjnerchandise.amount,name, =, Merchandise)) => 
Amount> 

This integrity constraint says that any amount of merchandise must be greater 
or equal to zero. 

in({o, Sender, Receiver, accept(Merchandise, Req-amount, Price), T), 

msgbox:getMessage(Sender)) A 
in({o. Sender, Receiver, refuse(Merchandise, Req-amount, Price), T), 

msgbox:getMessage(Sender) 
false 

This integrity constraint says that an agent cannot both accept and refuse an 
offer (the o element in the tuple returned by the msgbox:getMessage(Sender) 
code call means that the message is an output message from Sender to Re- 
ceiver, the last element of the tuple, T, is the time). Similar constraints could 
be added to enforce that an agent cannot both accept and negotiate an offer 
and that it cannot both refuse and negotiate. 

in(Min, oracle:select(storedjnerchandise.min, name, =, Merchandise)) A 
in(( o, Sender, Receiver, accept(Merchandise, Req-amount, Price), T), 
msgbox:getMessage(Sender)) A Price < Min => 
false 

This integrity constraint says that an agent cannot accept a proposal for a price 
lower than the minimum price allowed. Different from the previous ones, this 
constraint involves two different packages, the oracle one and the msgbox one. 

Other integrity constraints could be added to ensure the consistency of data 
inside the same package or across different packages. Note that most of the 
above constraints are enforced by the agent program. The reason why they 
should be explicitly stated is that, in the case of legacy systems, the legacy 
system's existing interface and the agent both access and update the same 
data. Thus, the legacy interface may alter the agent's state in ways that the 
agent may find unacceptable. The violation of the integrity constraits prevents 
the agent from continuing its execution in an inconsistent state. 
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• Agent Program: 

Do sendMessage(Seller, Buyer, accept(Merchandise, Req-amount, Price)) ^ 
in({i, Buyer, Seller, contractProposal(Merchandise, Req-amount, Price), T), 

msgbox:getMessage(Seller) ), 
in(Max, oracle:select(stored-merchandise.max, name, =, Merchandise)), 
in(Amount, oracle:select(storedjnerchandise.amount,name, =, Merchandise)), 
Price > Max, Amount > Req_amount 

This rule says that if all the conditions for accepting a proposal are met, namely 

1. the seller agent received a contractProposal from the buyer (the first element 
of the tuple in the first code call atom, i, says that the message is an input 

message), 

2. there is enough merchandise in the warehouse and 

3. the proposed price is greater than the Max value), 

then the seller sends a message to the buyer, saying that it accepts the proposal. 

O ship(Buyer, Merchandise, Req.amount) <— 

Do sendMessage(Seller, Buyer, accept(Merchandise, Req-amount, Price)) 
This rule says that if the seller agent accepts the buyer's proposal by sending a mes- 
sage to it, it is then obUged to ship the merchandise. 

Do sendMessage(Seller, Buyer, refuse(Merchandise, Req-amount, Price)) <— 
in({i. Buyer, Seller, contractProposal(Merchandise, Req.amount, Price), T), 

msgbox:getMessage(Seller)), 
in(Min, oracle:select(storedjnerchandise.max, name, =, Merchandise)), 
Price < Min 

If the price proposed by the buyer is below the Min threshold, then the seller agent 
refuses the proposal. 

Do sendMessage(Seller, Buyer, refuse(Merchandise, Req-amount, Price)) ■*— 
in((i, Buyer, Seller, contractProposal(Merchandise, Req-amount, Price), T), 

msgbox:getMessage(Seller) ), 
in(Amount, oracle:select(stored-merchandise.amount, name, =, Merchandise)), 
Amount < Req^amount 

The proposal is refused if there is not enough merchandise available. 

Do sendMessage(Seller, Buyer, 

contractProposal(Merchandise, Req_amount, Means)) ^ 

in({i. Buyer, Seller, contractProposal(Merchandise, Req-amount, Price), T), 

msgbox:getMessage(Seller) ), 
in(Max, oracle:select(stored_merchandise.max, name, =, Merchandise)), 
in(Min, oracle:select(stored^erchandise.min, name, =, Merchandise)), 
in(Amount, oracle:select(storedjnerchandise.amount, name, =, Merchandise)), 
Price > Min, Price < Max, Amount > Req^amount 
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in(Means, math:evalMeans(Max, Price)) 
This rule manages the case the seller agent has to send a contractProposal back to 
the buyer, since the proposed price is between Min and Max and there is enough 
merchandise available. 

6 Dynamic Logic 

Our introduction to dynamic logic is based on Section 8.2.5 of dWeiss 1999> . Dynamic 
logic can be thought of as the modal logic of action. Unlike traditional modal logics, the 
necessity and possibility operators of dynamic logic are based upon the kinds of actions 
available. As a consequence of this flexibility, dynamic logic has found use in a number of 
areas of Distributed Artificial Intelligence (DAI). We consider the propositional dynamic 
logic of regular programs, which is the most common variant. This logic has a sublanguage 
based on regular expressions for defining action expressions - these composite actions 
correspond to Algol-60 programs, hence the name of regular programs. 

Regular programs and formulae of the dynamic logic language are defined by mutual 
induction. Let PA be a set of atomic action symbols. Regular programs are defined in the 
following way: 

• all atomic action symbols in PA are regular programs; 

• if p and q are regular programs, then p ; qisa regular program meaning doing p and 
q in sequence; 

9 if p and q are regular programs, then {p + g) is a regular program meaning doing 
either p or q, whichever works; 

• if p is a regular program, then p* is a regular program meaning repeating zero or 
more (but finitely many) iterations of p; 

• if 1^ is a formula of the dynamic logic language, then ip7 is a regular program repre- 
senting the action of checking the truth value of formula tp; it succeeds if cp is indeed 
found to be true. 

{p + q) is nondeterministic choice. This action might sound a little unintuitive since a non- 
deterministic program may not be physically executable, requiring arbitrary lookahead to 
infer which branch is really taken. From a logical viewpoint, however, the characterization 
of nondeterministic choice is clear As far as pi is concerned, if p is true, this action suc- 
ceeds as a noop, i.e. without affecting the state of the world. If p is false, it fails, and the 
branch of the action of which it is part terminates in failure - it is as if the branch did not 
exist. 

Dynamic logic formulae are defined in the following way: 

• all propositional formulae are dynamic logic formulae; 

• if p is a regular program and is a dynamic logic formula, then [p] (yS is a dynamic 
logic formula which means that whenever p terminates, it must do so in a state 
satisfying p; 

• if p is a regular program and </? is a dynamic logic formula, then {p)p is a dynamic 
logic formula which means that it is possible to execute p and halt in a state satisfying 

</5; 
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• if (/3 and %jj are dynamic logic formulae, then ip W ip, (p A Tp, ^ V' ™d ""/^ ^re 
dynamic logic formulae. 

Let 5' be a set of states (or worlds). Let h be an interpretation function 

h: S X PROP -> {true, false} 

which says if a propositional formula belonging to PROP is true or false in a world be- 
longing to S. Let a C S X PA x 5" be a transition relation. 

The semantics of dynamic logic is given with respect to a model {S, a, h) that includes 
a set 5* of states, a transition relation a and an interpretation function h. 

In order to provide the semantics of the language we first define a class of accessibility 
relations {(3 is a atomic action symbol from PA; p and q are regular programs; r, s and t, 
with subscripts when necessary, are members of S): 

iff a{s,l3,t) 

iff there exists r such that s Rp r and r Rqt 
iff s Rp t or s Rq t 

iff there exists sq, . . . , Sn such that s = sq and t — Sn 

and for all z, < i < n, Si Rp Si+i 
iff {S, a, h) V 

In the following equivalences p ranges over regular programs and (p and ip are dynamic 
logic formulae. 

If (f is a propositional formula, its semantics is given through the h interpretation func- 
tion: 

{S,a,h) \=s f> iff h{s,Lp) — true 

The semantics of ip W ip, (p /\ tp, ip ^ ijj and -^p is given in the standard way: 

{S, a,h)^,pV^ iff (S, a, h) if or {S, a, h) 

{S, a, /i) |=s ^ ijj iff (5*, cr, h) ^ implies (5*, cr, h) ip 

etc... 

The semantics of {p)(p and [p]p is given as: 

{S, cr, h) \=s {p)p iff there exists t such that s Rp t and (5*, cr, h) |=t 
(5", cr, h) |=s [pjt/? iff for all t, s Rp t impHes (5", cr, h) f 

The reader can refer to the survey ( |Kozen and Tiuryn 1990| l for additional details. 

6.1 Dylog 

In a set of papers JGiordano et al. 1998llGiordano et al. 2000llBaldoni et al. 1997IIBaldoni et al.T998b . 
Baldoni, Giordano, Martelli, Patti and Schwind describe an action language and its exten- 
sion to deal with complex actions. In this section we provide a short description of the 
action language, taken from JBaldoni et al. 2000ii . and we introduce an implementation. 
The implementation language is called Dylog. 



s Rp t 

^ : q ^ 
5 Rp-\-q i 

S Rp i 

s Rip7 s 
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Primitive actions. In the action language each primitive action a G ^ is represented by a 
modahty [a]. The meaning of the formula [a]a, where a is an epistemic fluent, is that a 
holds after any execution of a. The meaning of the formula {a)a is that there is a possible 
execution of action a after which a holds. There is also a modality □ which is used to 
denote those formulae holding in all states. A state consists in a set of fluents representing 
the agent's knowledge in that state. They are called fluents because their value may change 
from state to state. The simple action laws are rules that allow to describe direct action 
laws, precondition laws and causal laws. 

Action laws define the direct effect of primitive actions on a fluent and allow actions 
with conditional effects to be represented. They have the form 

D{Fs ^ [a]F) 

where a is a primitive action name, -F is a fluent, and Fg is a fluent conjunction, meaning 
that action a initiates F, when executed in a state where the fluent precondition F^ holds. 

Precondition laws allow action preconditions, i.e. those conditions which make an action 
executable in a state, to be specified. Precondition laws have form 

D{Fs {a) true) 

meaning that when a fluent conjunction Fs holds in a state, execution of the action a is 
possible in that state. 

Causal laws are used to express causal dependencies among fluents and, then, to describe 
indirect effects of prinutive actions. They have the form 

□ (F, ^ F) 

meaning that the fluent F holds if the fluent conjunction Fs holds too. 

In the implementation language Dylog the notation for the above constructs is the fol- 
lowing: action laws have the form a causes F if Fs, precondition laws have the form a 
possible Jf Fs and causal laws have the form F if Fs. 

Procedures. Procedures are defined on the basis of primitive actions, test actions and other 
procedures. Test actions are needed for testing if some fluent holds in the current state and 
for expressing conditional procedures and are written as 

F ? 

where Fs is a fluent conjunction. 

A procedure po is defined by means of a set of inclusion axiom schemas of the form 

{Pl){P2) ■■■{Pn)'P^ {Po)^ 

where ip stands for an arbitrary formula. 

In Dylog implementations a procedure is defined as a collection of procedure clauses 
of the form pq isp pi & . ..& Pn {n > 0) where po is the name of the procedure and pi, 
i = 1 ... n is either a primitive action, a test action (written Fgl), a procedure name, or 
a Prolog goal. Procedures can be recursive and they are executed in a goal directed way, 
similarly to standard logic programs. 

Planning. A planning problem amounts to determining, given an initial state and a goal 
Fs, if there is a possible execution of a procedure p leading to a state in which Fg holds. 
This can be formulated by the query 

{p)Fs 

The execution of the above query returns as a side effect an answer which is an execution 
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trace ai, 02, . . . , am, i-e. a primitive action sequence from the initial state to the final one, 
which represents a linear plan. 

To achieve this, Dylog provides a metapredicate plan(p, Fs, as) where p is a procedure, 
Fs a goal and as a sequence of primitive actions, plan simulates the execution of the pro- 
cedure p. If p includes sensing actions, the possible execution traces of p (represented by 
sequences as of primitive actions) are generated according to the possible outcomes of the 
sensing actions. When one (simulated) outcome leads to a final state where Fs is not satis- 
fied, the interpreter backtracks and alternative outcome is simulated. Execution is separated 
from planning: a metapredicate exe(as) is provided to execute a plan. 

Sensing. In general, it is not possible to assume that the value of each fluent in a state is 
known to an agent, and it is necessary to represent the fact that some fluents are unknown 
and to reason about the execution of actions on incomplete states. To represent explicitly 
the unknown value of some fluents, an epistemic operator's is introduced in the language, 
to represent the beliefs an agent has on the world. B/ will mean that the fluent / is known 
to be true, B^/ will mean that the fluent / is known to be false, and fluent / is undefined 
in the case both -iB/ and -iB^/ hold. In the following, u{f) stands for ^B/ A ^B-i/. 

In Dylog there is no explicit use of the operator B but the notation is extended with 
the test u(f)?. Thus each fluent can have one of the three values: true, false and unknown. 
An agent will be able to know the value of f by executing an action that senses f (sensing 
action). One expresses that an action s causes to know whether f holds by the declaration 
s senses f. By applying Dylog 's planning predicate plan to a procedure containing sensing 
actions a conditional plan is obtained. The branches of this plan correspond to the different 
outcomes of sensing actions. 

6.7.7 Semantics 

As discussed in dBaldoni et al. 1998t . the logical characterization of Dylog can be pro- 
vided in two steps. First, a multimodal logic interpretation of a dynamic domain descrip- 
tion which describes the monotonic part of the language is introduced. Then, an abductive 
semantics to account for non-monotonic behavior of the language is provided. 

Definition 7 (Dynamic domain description) Given a set A of atomic world actions, a set 
S of sensing actions, and a set V of procedure names, let n_4 be a set of simple action laws 
for world actions, II^ a set of axioms for sensing actions, and Hp a set of inclusion axioms. 
A dynamic domain description is a pair (11, Sq), where 11 is the tuple (11^, 11^, Hp) and 
5*0 is a consistent and complete set of epistemic literals representing the beliefs of the agent 
in the initial state. 

Monotonic interpretation of a dynamic domain description. Given a dynamic domain de- 
scription (n, ^o). let us call -C(n.So) propositional modal logic on which (11, 5'o) is 
based. The action laws for primitive actions in 11^ and the initial beliefs in Sq define a 
theory S(n,So) ^(n.Sa)- The axiomatization of £(n,So)' called S(ji sq), contains: 

• all the axioms for normal modal operators 

• 7?(B), namely, for the belief modality B the axiom Bp ^ -iB-ip holds; 
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• SA{U), namely, the three axioms Up ^ p, U[p => ^ (Up => Uq) and 

Up ^ UUp; 

• Uif => [ai\ip, one for each primitive action Oi in (H, Sq); 

• (a + = (a)<^ V one for each formula ip; 

• = ip Aip, one for each formula 

• (a; = {a){b)(p, one for each formula ip; 

• Hp; 

• Hs. 

The model theoretic semantics of the logic /3(n,So) given through a standard Kripke 
semantics with inclusion properties among the accessibility relations. More details can be 
found in jBaldoni l^^St . 

Abductive semantics. The monotonic part of the language does not account for persistency. 
In order to deal with the frame problem, it is necessary to introduce a non-monotonic se- 
mantics for the language by making use of an abductive construction: abductive assump- 
tions will be used to model persistency from one state to the following one, when a prim- 
itive action is performed. In particular, we will assume that a fluent expression F persists 
through an action unless it is inconsistent to assume so, i.e. unless holds after the 
action. 

In defining the abductive semantics, the authors adopt (in a modal setting) the style of Es- 
hghi and Kowalski's abductive semantics for negation as failure ( |Eshghi and Kowalski 1989) 
They introduce the notation Ma to denote a new atomic proposition associated with a and 
a set of atomic propositions of the form M[ai] [02] • • • [flml^" and take them as being ab- 
ducibles^. Their meaning is that the fluent expression F can be assumed to hold in the state 
obtained by executing primitive actions oi , 02 , • • • , a,„ . Each abducible can be assumed to 
hold, provided it is consistent with the domain description (11, Sq) and with other assumed 
abducibles. 

More precisely, in order to deal with the frame problem, they add to the axiom system 
of >C(n, 5*0) the persistency axiom schema 

[ai][a2] • • • [am-i]F A M[ai][a2] • • • [a,n-i][am]F [ai][a2] • • • [am.-i][am]F 

where oi, 02, • • ••, a,„(m > 0) are primitive actions, and F is a fluent expression. Its 
meaning is that, if F holds after action sequence ai, 02, and F can be assumed 

to persist after action Um (i.e., it is consistent to assume M[ai][a2] • • • [a,„]F), then we can 
conclude that F holds after performing the sequence of actions oi , 02 , • • • , a,„ . 

Besides the persistency action schema, the authors provide the notions of abductive so- 
lutions for a dynamic domain description and abductive solutions to a query. 

6.1.2 Implementation 

Dylog is defined by a proof procedure which constructs a linear plan by making assump- 
tions on the possible results of sensing actions. The goal directed proof procedure, based 

^ M is not a modality but just a notation adopted in analogy to default logic, where a justification Mq intuitively 
means "a is consistent". 
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on negation as failure, allows a query to be proved from a given dynamic domain descrip- 
tion. The proof procedure is sound and complete with respect to the Kripke semantics of the 
modal logics -C(n, 5o). An interpreter based on this proof procedure has been implemented 
in SICStUS Prolog. This implementation allows to use Dylog as a programming language 
for executing procedures which model the behavior of an agent, but also to reason about 
them, by extracting from them linear or conditional plans. Details on the implementation 
can be found in ( |ALICE Home Page 2000) . 

6.1.3 Extensions 

In JBaldoni et al. 20 03a "Ba ldoni et al. 2003b> Dylog agents are extended to represent be- 
liefs of other agents in order to reason about conversations. They are also enriched with a 
communication kit including a primitive set of speech acts, a set of special "get message" 
actions and a set of conversation protocols. 

6.7.4 Example 

In the following example, the predicate is has its usual meaning as in Prolog programs: it 
evaluates the value of the expression at its right and checks if this value unifies with the 
term at its left. 

• Functional fluents: 

functionalFluent(storing/2). 
functionalFluent(newjnessage/2). 

The amount of merchandise stored and the new incoming messages are facts 
which change during the agent's life. The number after the predicate's name 
is its arity. 

• Unchangeable knowledge base (Prolog facts): 

min-price(orange, 1 ). 
max-pnce(orange, 2). 

The minimum and maximum prices for oranges do not change over time. 

• Initial observations: 

obs(storing(orange, 1000)). 

Initially, there are 1000 oranges the seller agent can sell. 

• Primitive actions: 

receive 

This action senses if a fluent new^essage(Sender, Message) is present in the 
caller's mailbox. It is characterized by the following laws and routines: 

Precondition laws: 
receive possible Jf true. 

It is always possible to wait for a new message to arrive. 
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Sensing: 

receive senses newjnessage(Sender, Message). 

The receive action senses the value of the new-niessage(Sender, Message) 
functional fluent. 
Sensing routine: 

senses-routine(-, new-message, Sender, Message) :- .... 
A Prolog routine that we do not show here implements the sensing action 
by waiting for messages matching the couple (Sender, Message) in the 
caller's mailbox. 
send(Sender, Receiver, Message) 

This action puts the couple (Sender, Message) in the Receive fs mailbox by 
modifying the state of the newjnessage(Sender, Message) functional fluent 
of the Receiver's agent. For sake of conciseness, we avoid discussing all the 
details of this action. 

ship(Buyer, Mercliandise, Req^Amnt, Price) 

This action ships the required merchandise to the Buyer agent. It is character- 
ized by the following action laws and precondition laws: 

Action laws: 

ship(Buyer, Mercliandise, Req_Amnt, Price) 

causes storing(Merchandise, Amount) 

if storing(Merchandise, 01d_Amount) & 
(Amount is 01d_Amount - Req-Amnt). 
Shipping some merchandise causes an update of the stored amount of that 
merchandise. 
Precondition laws: 

ship(Buyer, Mercliandise, Req-Amnt) 

possible Jf storing(Merchandise, Old-Amount) & 
(OldJ^ount > ReqJ^mnt) & 
max-price(Merchandise, Max) & (Price > Max). 
Shipping merchandise is possible if there is enough merchandise left and 
if the price is higher than the maximum price established for that merchan- 
dise. 

Procedures: 

seller_agent-cycle isp 
receive & 

managC-message & 
seller.agent-cycle. 

The main cycle for the seller agent consists in waiting for a message, managing 
it and starting waiting for a message again. 

manage jnessage isp 
newjmessageiB uyer, 

contractProposal(Mercliandise, ReqJ^^mnt, Price))? & 
storing(Merchandise, 01d_Amount)? & 
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(OM_Amount > Req.Amnt) & 

max-price(Merchandise, Max)? & (Price > Max) & 

ship(Buyer, Merchandise, Req_Amnt, Price) & 

send(seller. Buyer, accept(Merchandise, Req_Amnt, Price)) 
If all conditions are met to ship the merchandise, then the merchandise is 
shipped and the seller sends a message to the Buyer in which it accepts the 
Buyer's proposal. 

manage_message isp 
new_message(B uyer, 

contractProposal(Mercliandise, ReqJkmnt, Price))? & 
storing(Merchandise, 01d_Amount)? & 
(01d_Amount < Req.Amnt) & 

send(seUer, Buyer, refuse(Merchandise, Req_Amnt, Price)) 
If there is not enough merchandise, the seller agent refuses to send the mer- 
chandise. 

manage_message isp 
new_message(B uyer, 

contractProposal(Merchandise, Req-Amnt, Price))? i& 
min-price(Mercliandise, Min)? & (Price < Min) 
send(seUer, Buyer, refuse(Merchandise, Req_Amnt, Price)) 

If the price is too low, the seller agent refuses to send the merchandise. 

manage_message isp 
new_message(B uyer, 

contractProposal(Merchandise, Req-Amnt, Price))? & 
storing(Merchandise, 01d_Amount)? & 
(01d_Amount > Req.Amnt) & 
max-price(Merchandise, Max)? & (Price < Max) & 
min-price(Merchandise, Min)? & (Price > Min) & 
(New_Price is (Price + Max) / 2) & 

send(seUer, Buyer, contractProposal(Merchandise, Req_Amnt, New -Price)) 
In case the conditions are met to send a counter-proposal to the Buyer agent, 
the seller sends it with the price it is willing to accept. 



7 Temporal Logic 

In this section we define a first-order temporal logic based on discrete, linear models with 
finite past and infinite future, called FML (Fis her 1992) . FML introduces two new connec- 
tives to classical logic, until (U) and since (S), together with a number of other operators 
definable in terms of U and S. The intuitive meaning of a temporal logic formula (p Uip 
is that ijj will become true at some future time point t and that in all states between and 
different from now and t, if will be true. S is the analogous of U in the past. 



38 



V. Mascardi, M. Martelli and L. Sterling 



Syntax of FML. Well-formed formulae of FML (WFF/) are generated in the usual way 
as for classical logic, starting from a set Cp of predicate symbols, a set of variable 
symbols, a set Cc of constant symbols, the quantifiers V and 3, and the set Ct of terms 
(constants and variables). The set WFF/ is defined by: 

• If ti, • • •, tn are in Ct and p is a predicate symbol of arity n, then • • •, i„) is in 
WFF/. 

• true and faJse are in WFF/ . 

• IfA and B are in WFF/, then so are ^A, A^B,A KB, A SB, and (A). 

• If ^ is in WFF/ and v is in £„, then 3v ■ A and Vu • A are both in WFF/. 

The other classical connectives are defined in terms of the ones given above, and sev- 
eral other useful temporal connectives are defined in terms of U and S (we follow the 
characterization provided in ( Fin ger etal. 1993) as well as the notation used there): 





(fi is true in the next state 


[false U(p] 


Oip 


the current state is not the initial state, and was true in 
the previous state 


[false S(p] 


•f 


if the current state is not the initial state, then (p was true in 
the previous state 


[- O^^] 




If will be true in some future state 


[trueUip] 




If was true in some past state 


[true Sip] 


Dip 


If will be true in all future states 






(f was true in all past states 





Temporal formulae can be classified as follows. A state-formula is either a literal or a 
boolean combination of other state- formulae. 
Strict future-time formulae are defined as follows: 

If A and B are either state or strict future-time formulae, then A UB is a strict 
future-time formula. 

If A and B are strict future-time formulae, then -^A, AAB, and (A) are strict future- 
time formulae. 

Strict past-time formulae are defined as the past-time duals of strict future-time formulae. 
Non-strict classes of formulae include state-formulae in their definition. 

Semantics of FML. The models for FML formulae are given by a structure which consists 
of a sequence of states, together with an assignment of truth values to atomic sentences 
within states, a domain V which is assumed to be constant for every state, and mappings 
from elements of the language into denotations. More formally, a model is a tuple Ai — 
(a,!), he, hp) where a is the ordered set of states sq, si, S2, • • •, he is a map from the 
constants into V, and hp is a map from N x Cp into P" — > { true, false } (the first 
argument of hp is the index i of the state Si). Thus, for a particular state s, and a particular 
predicate p of arity n, h{s,p) gives truth values to atoms constructed from n-tuples of 
elements of V. A variable assignment hy is a mapping from the variables into elements 
of v. Given a variable and the valuation function h^, a term assignment r^/j is a mapping 
from terms into V defined in the usual way. 
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The semantics of FML is given by the |= relation that gives the truth value of a formula 
in a model 7W at a particular moment in time i and with respect to a variable assignment. 

{M, i, K) 1= true 
(A^, j, hy) y= false 

{M,i,K) \= p{xi,- ■ -^Xn) iff hp{i,p){Tyh{xi),- ■ -^Tyhixn)) = true 

{M,i,hy)^^ip iff (M,i,hy)^ip 

{M,i,K) \^ ip\/ ip iff {M,i,hy) \= ip OT {M,i,K) \^ if} 

{Ai, i, hy) \= (fi Uip iff for some k such that i < k, {Ai, k,hv) \= ip 

and for all j, if i < j < k then {A4,j, hy) \= ip 
{A4, i, hy) 1= ip Sip iff for some k such that < A; < i, {A4, k,hy) \^ tp 

and for all j, if k < j < i then {A4,j, hy) \= (f 
{M,t,hy) \^yx ■ (f iff foiall d eV,{M, I, hy[d/x]) \^ (f 

{A4, i,hy) \= 3x ■ ip iff there exists d E V such that {Ai, i,hy[d/x]) \= (p 



7.1 Concurrent METATEM 

Concurrent METATEM ( |Fisher and Barringer 199TllFisher 1993l|Fisher and Wooldridge 1993| l 
is a programming language for distributed artificial intelligence based on FML. A Concur- 
rent METATEM system contains a number of concurrently executing agents which are able 
to communicate through message passing. Each agent executes a first-order temporal logic 
specification of its desired behavior. Each agent has two main components: 

• an interface which defines how the agent may interact with its environment (i.e., 
other agents); 

• a computational engine, which defines how the agent may act. 
An agent interface consists of three components: 

• a unique agent identifier which names the agent 

• a set of predicates defining what messages will be accepted by the agent - they are 
called environment predicates; 

• a set of predicates defining messages that the agent may send - these are called 
component predicates. 

Besides environment and component predicates, an agent has a set of internal predicates 
with no external effect. 

The computational engine of an object is based on the METATEM paradigm of exe- 
cutable temporal logics. The idea behind this approach is to directly execute a declarative 
agent specification given as a set of program rules which are temporal logic formulae of 
the form: 

antecedent about past consequent about future 
The past-time antecedent is a temporal logic formula referring strictly to the past, whereas 
the future time consequent is a temporal logic formula referring either to the present or 
future. The intuitive interpretation of such a rule is on the basis of the past, do the fu- 
ture. The individual METATEM rules are given in the FML logic defined before. Since 
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METATEM rules must respect the past implies future form, FML formulae defining agent 
rules must be transformed into this form. This is always possible as demonstrated in 
HBarringer et al. 1990| l. 

7.7.7 Semantics 
METATEM semantics is the one defined for FML. 

7.7.2 Implementation 

Two implementations of the imperative future paradigm described in this section have been 
produced. The first is a prototype interpreter for propositional METATEM implemented in 
Scheme JFisher 1990t . A more robust Prolog-based interpreter for a restricted first-order 
version of METATEM has been used as a transaction programming language for temporal 
databases ( |Finger et al. 1991| l. 

7.7.5 Extensions 

Two main directions have been followed in the attempt of extending Concurrent METATEM, 
the first one dealing with single agents and the second one dealing with MASs. 

• Single Concurrent METATEM agents have been extended with deliberation and be- 
liefs (.Fisher 1997 ) and with resource-bounded reasoning (.Fisher and Ghidini 1999t . 

• Compilation techniques for MASs specified in Concurrent METATEM are analyzed 
in (IKellett and Fis her 1997aJ. Concurrent METATEM has been proposed as a coordi- 
nation language in (.Kellett and Fisher 199 7b i. The definition of groups of agents in 
Concurrent METATEM is discussed in (|Fisher 1998 Fisher and Kakoudakis 20()^. 

The research on single Concurrent METATEM agents converged with the research on Con- 
current METATEM MASs in the paper dFisher and Ghidini 2002t where "confidence" is 
added to both single and multiple agents. The development of teams of agents is discussed 
in lIHirsch et al. 2002> . 

7.7.4 Example 

The Concurrent METATEM program for the seller agent may be as follows: 

• The interface of the seller agent is the following: 

seller(contractProposal)[accept, refuse, contractProposal, ship] 
meaning that: 

- the seller agent, identified by the seller identifier, is able to recognize a con- 
tractProposal message with its arguments, not specified in the interface; 

- the messages that the seller agent is able to broadcast to the environment, in- 
cluding both communicative acts and actions on the environment, are accept, 
refuse, contractProposal, ship with their arguments. 
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• The internal knowledge base of the seller agent contains the following rigid predi- 
cates (predicates whose value never changes): 

min-price(orange, 1 ). 
niax-price(orange, 2). 

• The internal knowledge base of the seller agent contains the following Sexible pred- 
icates (predicates whose value changes over time): 

storing(orange, 1000). 

• The program rules of the seller agent are the following ones (as usual, lowercase 
symbols are constants and uppercase ones are variables): 

V Buyer, Merchandise, Req_Amnt, Price. 

0[contractProposal(Buyer, seller. Merchandise, Req_Amnt, Price) A 
storing(Merchandise, Old-Amount) A 
01d_Amount > Req.Anmt A 
max-price(Merchandise, Max) A Price > Max] =^ 
[ship(Buyer, Merchandise, Req-Amnt, Price) A 
accept(seller. Buyer, Merchandise, Req-Ainnt, Price)] 
If there was a previous state where Buyer sent a contractProposal message 
to seller, and in that previous state all the conditions were met to accept the 
proposal, then accept the Buyer's proposal and ship the required merchandise. 

V Buyer, Merchandise, Req-Amnt, Price. 

0[contractProposal(Buyer, seller. Merchandise, Req-Aimit, Price) A 

storing(Merchandise, 01d_Amount) A 

min-price(Merchandise, Min) A 

Old-Amount < Req.Amnt V Price < Min] 

refuse(seller. Buyer, Merchandise, Req-Amnt, Price) 
If there was a previous state where Buyer sent a contractProposal message 
to seller, and in that previous state the conditions were not met to accept the 
Buyer's proposal, then send a refuse message to Buyer. 

V Buyer, Merchandise, Req-Amnt, Price. 

0[contractProposal(Buyer, seller. Merchandise, Req-Amnt, Price) A 

storing(Merchandise, 01d_Amount) A 

min-price(Merchandise, Min) A 

max-price(Merchandise, Max) A 

Old-Amount > Req-Airmt A 

Price > Min A Price < Max A 

NewMce = (Max + Price)/ 2] =^ 

contractProposal(seller, Buyer, Merchandise, Req-Amnt, New-Price) 
If there was a previous state where Buyer sent a contractProposal message to 
seller, and in that previous state the conditions were met to send a contract- 
Proposal back to Buyer, then send a contractProposal message to Buyer with 
a new proposed price. 
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8 Linear Logic 

Linear logic (I Girard 1987t has been introduced as a resource-oriented refinement of clas- 
sical logic. The idea behind linear logic is to constrain the number of times a given as- 
sumption (resource occurrence) can be used inside a deduction for a given goal formula. 
This resource management, together with the possibility of naturally modeling the notion 
of state, makes linear logic an appealing formalism to reason about concurrent and dynam- 
ically changing systems. 

Linear logic extends usual logic with new connectives: 

• Exponentials: "!" {of course) and "?" {why not?) express the capability of an ac- 
tion of being iterated, i.e. the absence of any reaction. I A means infinite amount of 
resource A. 

• Linear implication: {loUi) is used for causal implication. The relationship between 
linear implication and intuitionistic implication "=>" is A ^ B = {IA)^:B 

• Conjunctions: (g) {times) and & {with) correspond to radically different uses of the 
word "and". Both conjunctions express the availability of two actions; but in the case 
of 0, both actions will be done, whereas in the case of & only one of them will be 
performed (we shall decide which one). Given an action of type A^ B and an action 
of type A^: C there will be no way of forming an action of type A-oB ® C, since 
once resource A has been consumed for deriving B, for example, it is not available 
for deriving C . However, there will be an action A^B&zC. In order to perform this 
action we have to first choose which among the two possible actions we want to 
perform, and then do the one selected. 

• Disjunctions: there are two disjunctions in linear logic, © {plus), which is the dual of 
&, and ^ {par), which is the dual of ® . ® expresses the choice of one action between 
two possible types. ^ expresses a dependency between two types of actions and can 
be used to model concurrency. 

• Linear negation: (■)-'- {nil) expresses linear negation. Since linear implication will 
eventually be rewritten as ^4-'- ^ S, nil is the only negative operation of logic. Linear 
negation expresses a duality 

action of type A = reaction of type A^ 

• Neutral elements: there are four neutral elements: 1 (w.rt. (g)), _L (w.rt. T (w.r.t. 
&) and (w.rt. ©). 

Semantics. In Tabled we provide the semantics of full linear logic by means of a proof 
system. Sequents assume the one-sided, dyadic form h : F. 8 and F are multisets of 
formulae. 9 is the so-called unbounded part, while F is the bounded one. In other words, 
formulae in 9 must be implicitly considered as exponentiated (i.e., preceded by ?) and thus 
can be reused any number of times, while formulae in F must be used exactly once. 

We opted for defining the semantics of linear logic by means of a proof system both 
because understanding the proof rules requires less background than understanding an ab- 
stract semantics and for consistency with the style used for the semantics of Ehhf ■ Other 
semantics have been defined for linear logic: a complete description of phase semantics 
and coherent semantics is given in ( iGirard 1987> while game semantics is dealt with in 
JBlass 1992t . 
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id cut ahs 



he:F,F^ he:r,A i-e,F:r 

he-r he:r,F,G he,F:r 



he:r,± hQ:r,F^G i-e:r,?F 

he:r,F 1-6: A, G |-e:F 



he:l he:r,A,F®G |-e:!F 

he:r,F i-e:r, G he:r,F[c/x] 

T & 



i-e:r,T he:r,F&G |-e:r,Va;-F 

|-e:r,F l-e:r, G h e ; r, F[i/a;] 



i-e:r,FeG he:r,FeG i-e;r,3a;-F 

Table 1 . A one-sided, dyadic proof system for linear logic 



8-1 £hiif 

The language £hhf ( IDelzanno 1997IIDelzanno and Martelli 200 U is an executable specifi- 
cation language for modeling concurrent and resource sensitive systems, based on the gen- 
eral purpose specification logical language Forum (Miller 1996V £hhf is a multiset-based 
logic combining features of extensions of logic programming languages like AProlog, e.g. 
goals with implication and universal quantification, with the notion of formulae as re- 
sources at the basis of linear logic. S^hf uses a subset of linear logic connectives and a 
restricted class of formulae as defined later. An f^/j/ -program F" is a collection of multi- 
conclusion clauses of the form: 



Ai^... ^Ano-Goal, 

where the Ai are atomic formulae, the linear disjunction Ai ^ . . . ^ An corresponds to 
the head of the clause and Goal is its body. Furthermore, Ac^B is a linear implication. 
Execution of clauses of this kind concurrently consumes the resources (formulae) they 
need in order to be applied in a resolution step. 

Given a multiset of atomic formulae (the state of the computation) Qq, a resolution step 
fio — > ^1 can be performed by applying an instance Ai ^ . . . ^ Anc-G of a clause in 
the program P, whenever the multiset 8 consisting of the atoms Ai, . . . , An is contained 
in f2o- ^^1 is then obtained by removing Q from fig and by adding G to the resulting mul- 
tiset. In the £hhf interpreter, instantiation is replaced by unification. At this point, since 
G may be a complex formula, the search rules (i.e., the logical rules of the connectives 
occurring in G) must be exhaustively applied in order to proceed. Such a derivation cor- 
responds to a specific branch of the proof tree of a multiset fi. fl represents the current 
global state, whereas P describes a set of clauses that can be triggered at any point during 
a computation. 



44 



V. Mascardi, M. Martelli and L. Sterling 



£hhf provides a way to "guard" the application of a given clause. In the extended type 
of clauses 

Gik...kG,n ^{Ai^...-^ ^„c^GoaO, 

the goal-formulae Gi are conditions that must be solved in order for the clause to be trig- 
gered. 

New components can be added to the current state by using goal-formulae of the form 
Gi G2. In fact, the goal Gi ^ G2, A simply reduces to Gi, G2, A. Conditions over 
the current state can be tested by using goal-formulae of the form G1&G2. In fact, the 
goal G1&G2, A reduces to Gi, A and G2, A. Thus, one of the two copies of the state can 
be consumed to verify a contextual condition. Universal quantification in a goal-formula 
\/x ■ G can be used to create a new identifier t which must be local to the derivation tree of 
the subgoal G[t/x]. Finally, the constant T succeeds in any context and the constant _L is 
simply removed from the current goal. 

8.1.1 Semantics 

The £hhf operational semantics is given by means of a set of rules describing the way se- 
quents can be rewritten. See (Delzanno and Martelli 2001 1 for all details and for the results 
of correctness and completeness w.r.t. linear logic. According to the proof as computation 
interpretation of linear logic, sequents represent the state of a computation. 
Sequents assume the following form (simplified for the sake of presentation): 

where F and A are multi-sets of P-formulae (respectively the unbounded and bounded 
context), and il is a multi-set of ^-formulae which contains the concurrent resources 
present in the state. The class of formulae is restricted to two main classes, V- and Q- 
formulae (D stands for definite clauses and G for goals): 

V ::= D & 7? I Vx ■ P I Hc^G \ V ^ G\H 

Q ■■■■= Q&iQ\g^Q\\ix-g\v-:>g\v^g\A\L\T 
n ::= H'^n\Ar 

A represents a generic atomic formula, whereas Ar is a rigid atomic formula, i.e., whose 
top-level functor symbol is a constant. 

The rules of S^hf are divided into right rules (or search rules) and left rules. Right rules 
are used to simplify goals in fl until they become atomic formulae. They define the be- 
havior of the various connectives: T is used to manage termination, ± to encode a null 
statement, & to split a computation into two branches which share the same resources, V 
to encode a notion of hiding, ^ to represent concurrent execution, and -o to augment 
the resource context (respectively, the unbounded and the bounded context). 

Left rules define backchaining over clauses built with the connectives <^ and c^. As 
described above, the rule for o- is similar to Prolog rewriting, except that multiple-headed 
clauses are supported; besides, a clause can be reusable or not depending on which context 
it appears in. The rule for allows to depart an independent branch in an empty context 
(this is often useful to verify side conditions or make auxiliary operations). 
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8.L2 Implementation 

A working interpreter for Shhf has been developed by Bozzano in Lambda Prolog, a 
language originally developed by Miller and Nadathur, which offers support for higher- 
order abstract syntax, a new and increasingly popular way to view the structure of objects 
such as formulae and programs. 

The code of the Ehhf interpreter can be downloaded from fEhhf FTP Area 1998V where 
an example implementing the specification described in LBozzano et al. 1999aj is also 
downloadable. 

8.1.3 Extensions 

In the MAS context, Ehhf has been used to specify an architecture based on the BDI {Be- 
lief, Desires, Intentions ( |Rao and Georgeff 1995^ ) approach (Bozz ano et al. 1999b *) and to 
verify the correctness of a MAS where agents were specified by means of event-condition- 
action rules JBozzano et al. 1999a> . 

Ehhf has also been used to model object-oriented and deductive databases JBozzano et al. 1997t 
and object calculi ( jBugliesi et al. 2000) . 

8.1.4 Example 
The Ehhf program for the seller agent may be as follows: 

• Seller's initial facts: 

min-price(orange, 1 ). 
max-price(orange, 2). 
storing(orange, 1000). 
seller-mailbox([] ). 

We assume that every agent has a mailbox which all the agents in the system 
can update by calling a send predicate. The mailbox of the seller agent is 
initially empty (we are using Prolog syntax for lists). 

• Seller's life cycle: 

V Message, OtherMessages. 

seller-mailbox([Message\ OtherMessages]) ^ 
seller-cycle 

manage(Message) ^ 

seller-mailbox(OtherMessages) ^ 

seller-cycle. 

To satisfy the seller-cycle goal, the seller agent must have at least one mes- 
sage in its mailbox. In this case, it consumes the seller-mailbox([Message\ 
OtherMessages]) and seller-cycle goals and produces the new goals of man- 
aging the received message {manage(Message)), removing it from the mailbox 
{seller-mailbox(OtherMessages), where the list of messages does not contain 
Message any more) and cycling (seller-cycle). 
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Seller's rules for managing messages: 

V Buyer, Merchandise, Req_Amnt, Price. 

Old-Amount > Req^nmt & 

difference(01d-Amount, Req-Amnt, Remaining ^mnt) & 
max-price(Merchandise, Max) & Price > Max 

manage(contractProposal(Buyer, Merchandise, Req-Amnt, Price)) ^ 
storing(Merchandise, Old-Amount) o- 

storing(Merchandise, Remaining-Amount) ^ 
ship(Buyer, Merchandise, Req_Amnt, Price) ^ 
send(Buyer, accept(seller. Merchandise, Req-Amnt, Price)). 
The goals before the => connective are not consumed by the execution of the 
rule: they are used to evaluate values idifference(01d-Amount, Req-Amnt, Re- 
maining_Amnt)), to compare values (01d_Amount > Req_Amnt and Price > 
Max) and to get the value of variables appearing in facts that are not changed 
by the rule imax-price(Merchandise, Max)). In this case, they succeed if the 
conditions for shipping merchandise are met. The goals storing(Merchandise, 
Old-Amount) and manage(contractProposal(Buyer, Merchandise, Req-Amnt, 
Price)) are consumed; they are rewritten in storing(Merchandise, Remain- 
ing_Amount) (the information about stored merchandise is updated), ship(Bu- 
yer. Merchandise, Req_Amnt, Price) (the required amount of merchandise is 
shipped) and send(Buyer, accept(seller. Merchandise, Req-Amnt, Price) (the 
message for informing Buyer that its proposal has been accepted is sent). The 
ship predicate will be defined by some rules that we do not describe here. 

V Buyer, Merchandise, Req^Amnt, Price. 

min-price(Merchandise, Min) & Price < Min => 

manage(contractProposal(Buyer, Merchandise, Req_Amnt, Price)) o- 
send(Buyer, refuse(seller. Merchandise, Req-Amnt, Price). 
If the proposed price is too low {min-price(Merchandise, Min) & Price < Min) 
the Buyer's proposal is refused. 

V Buyer, Merchandise, Req-Amnt, Price. 

storing(Merchandise, 01d_Amount) & 01d_Amount < Req_Amnt 

manage(contractProposal(Buyer, Merchandise, Req-Amnt, Price)) o- 
send(Buyer, refuse(seller. Merchandise, Req-Amnt, Price)). 
If there is not enough merchandise stored, the Buyer's proposal is refused. 

V Buyer, Merchandise, Req-Amnt, Price. 

01d_Amount > Req.Amnt & 
min-price(Merchandise, Min ) & Price > Min & 
max-price(Merchandise, Max) & Price < Max & 
eval-means(Max, Price, Means) => 

manage(contractProposal(Buyer, Merchandise, Req-Amnt, Price)) o- 
send(Buyer, 

contractProposal(seller, Merchandise, Req_Amnt, Means)). 
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If there is enough merchandise and the price proposed by Buyer is between the 
minimum and maximum prices estabHshed by the seller, the means of Price 
and Max is evaluated {eval-means(Max, Price, MeanPrice)) and a contractPro- 
posal with this new price is sent to Buyer. 

9 A Comparison among the Specification Languages 

In this section we compare the agent specification languages introduced so far along twelve 
dimensions whose choice is mainly driven by (Juan et al. 2003a ). Although it is difficult to 
assess if the following twelve dimensions are all and the only ones relevant for character- 
izing an agent programming language, we think that they represent a reasonable choice. 

In Section Wa] we introduce the twelve dimensions. For each one we explain why it 
is relevant for characterizing an agent programming language. We also formulate some 
questions whose answers, given in Section l9^ help in understanding how each of the six 
languages analyzed in this paper supports the given dimension. 

9.1 Comparison Dimensions 

This paper is mainly concerned with the prototyping stage rather than with the develop- 
ment of a final application. For this reason we avoid discussing all those technical details 
which are not necessary for modeUng, verifying and prototyping a MAS, such as efficiency, 
support for mobility and physical distribution, support for integration of external packages. 
Indeed, we concentrate on dimensions related with the basic definition of an agent quoted 
in the introduction ( [Jennings et al. 1998) (dimensions 2, 3, 4, 5), on dimensions related 
with the agent representation and management of knowledge (dimension 6), on dimen- 
sions related with the ability of a set of agents to form a MAS (dimensions 7, 8, 9), and 
on dimensions which, although not peculiar of an agent programming language, are par- 
ticularly important for the correct development of agents and a MAS (dimensions 10, 11, 
12). 

1 . Purpose of use. Understanding in which engineering/development stage the language 
proves useful is necessary to adopt the right language at the right time. 

• Is the language suitable for running autonomous agents in a real environment? 

• Is the language suitable for MAS prototyping? 

• Is the language suitable for verifying properties of the implemented MAS? 

2. Time. Agents must both react in a timely fashion to actions taking place in their 
environment and plan actions in a far future, thus they should be aware of time. 

• Is time dealt with explicitly in the language? 

• Are there operators for defining complex timed expressions? 

3. Sensing. One of the characterizing features of an agent is its ability to sense and 
perceive the surrounding environment. 

• Does the language provide constructs for sensing actions (namely, actions 
which sense the environment)? 



48 



V. Mascardi, M. Martelli and L. Sterling 



4. Concurrency. Agents in a MAS execute autonomously and concurrently and thus it is 
important that an agent language provides constructs for concurrency among agents 
(external concurrency) and concurrency within threads internal to the agent (internal 
concurrency). 

• Does the language allow the modeling of concurrent actions within the same 
agent? 

• Does it support concurrency among executing agents? 

5. Nondeterminism. The evolution of a MAS consists of a nondeterministic succession 
of events. 

• Does the language support nondeterminism? 

6. Agent knowledge. The predominant agent model attributes human-Uke attitudes to 
agents. The agent knowledge is often characterized by beliefs, desires and intentions 
l |Rao and Georgeff 1995^ . Often, human beings are required to reason in presence of 
incomplete and uncertain knowledge. 

• Does the language support a BDI-style architecture? 

• Does the language support incomplete agent knowledge? 

• Does it support uncertainty? 

7. Communication. Agents must be social, namely, they must be able to communicate 
either with other agents and with human beings. 

• Are communication primitives provided by the language? 

• Is it necessary for an agent to know details of another agent's implementation 
in order to communicate with it, or does communication take place on a more 
abstract level? 

• Is the programming language tied to some specific agent communication lan- 
guage? 

8. Team working. The ability to form team is becoming more and more important in 
the intelligent agents research area as witnessed by the increasing number of re- 
searchers which address this specific topic'^. Building a team may involve coordina- 
tion/negotiation protocols. 

• Is the language suitable for defining and programming teams? 

• Is the language suitable for expressing coordination/negotiation protocols? 

9. Heterogeneity and knowledge siiaring. In many real systems agents are heteroge- 
neous since they were developed by different organizations with different (some- 
times opposite) purposes in mind. 

• Which are the necessary conditions that agents must respect to interact? 

^ For example, during the Second International Joint Conference on Autonomous Agents and Multiagent Sys- 
tems (AAMAS) which took place in Melbourne in July 2003 an entire session was devoted to team working, 
with four papers presented; a large number of documents on team work is publis hed by the T EAMCORE Re- 
search Group at the University of Southern California ^The TEAMCORE Research Group Home Page 2003} . 
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• Do agents need to share the same ontology? 

• Are agents able to cope with the heterogeneity of information? 

10. Programming style. The language programming style may be more or less suitable 
for implementing a given reasoning mechanism or a given agent architecture. 

• Does the language support goal-directed reasoning, forward reasoning, reac- 
tiveness? 

• Does the agent programming language require to stick to a fixed agent model 
or does it leave the choice to the programmer? 

1 1 . Modularity. Agent programs are typically very complex and a developer would ben- 
efit from structuring them by defining modules, macros and procedures. 

• Does the language provide constructs for defining modules, macros and/or 
procedures? 

12. Semantics. Due to the complexity of languages for agent, providing a clear semantics 
is the only means to fully understanding the meaning of the constructs they provide 
and thus exploiting the potentialities of the language. 

• Is a formal semantics of the language defined? 

• Are there results explaining the link between system execution and formal 
semantics? 

9.2 The Six Languages Compared along the Twelve Dimensions 

Purpose of use. ConGolog allows the design of flexible controllers for agents living in 
complex scenarios. Its extension IndiGolog provides a practical framework for real robots 
that must sense the environment and react to changes occurring in it, and Legolog is an 
agent architecture for running IndiGolog high-level programs in Lego MINDSTORM 
robots. GASL ( [Shapiro et al. 2002|f ) is an environment based on ConGolog which pro- 
vides a verification environment. 

AGENT-0 is suitable for modeling agents and MAS. We are not aware of papers on the 
suitability of AGENT-0 or its extensions for verifying MAS specifications or implementing 
real agent systems. 

IMPACT'S main purpose is to allow the integration of heterogeneous information sources 
and software packages. It has been used to develop real applications ranging from combat 
information management where IMPACT was used to provide yellow pages matchmaking 
services to aerospace applications where IMPACT technology has led to the development 
of a multiagent solution to the "controlled flight into terrain" problem. The lADE environ- 
ment provides support for monitoring the MAS evolution. 

Dylog is suitable for building agents acting, interacting and planning in dynamic envi- 
ronments. A web agent system called WLog has been developed using Dylog to demon- 
strate Dylog's potential in developing adaptative web applications as software agents. 

In dFisher 1994t a range of sample applications of Concurrent METATEM utilizing both 
the core features of the language and some of its extensions are discussed. They include 
bidding, problem solving, process control, fault tolerance. Concurrent METATEM has the 
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potential of specifying and verifying applications in all of the areas above ( |Fisher and Wooldridge 1997) 
but it is not suitable for the development of real systems. 

£hhf can be used for MAS modeling and verification, as discussed in dBozzano et al. 1999at . 
It is not suitable for running autonomous agents in a real environment. 

Time. In ConGolog time instants correspond directly with situations: sq is the agent's 
situation at time 0, do{[ai, ■ ■ ■, an], sq) is the agent's situation at time n. We can think 
of a succession of situations as a discrete time line. Most temporal modalities as found in 
temporal logics can be expressed in situation calculus using quantification over situations. 

In AGENT-0 time is included in all the constructs of the language. The operations al- 
lowed on time variables are only mathematical operations (sums and differences). When 
programming an agent, it is possible to specify the time grain of its execution. 

Time is a central issue in Concurrent METATEM specifications: there are a lot of time- 
based operators ("since, until, in the next state, in the last state, sometime in the past, 
sometime in the future, always in the past, always in the future") which allow the definition 
of complex timed expressions. 

As far as the other languages are concerned, time does not appear in expressions of the 
language, either explicitly or implicitly. 

Sensing. Dylog is the only language which provides an explicit construct for defining ac- 
tions which sense the value of a fluent. However all the languages allow perception of 
values of atoms that are present in their knowledge base. Whether this knowledge base 
correctly maintains a model of the environment or not, and thus whether it is possible to 
"sense" the surrounding environment or not, depends on the given specification. In our run- 
ning example, all the agents maintain the information about the stored amount of oranges 
locally in their knowledge bases. In practice this information should be obtained by physi- 
cally sensing the environment (the warehouse, in this case), since nothing ensures that the 
agent's information is consistent with the environment state. 

It is worthwhile to note that, in a certain sense, the IMPACT agent programming lan- 
guage is the only one which really senses its (software) environment by means of the code 
caUs mechanism: this mechanism allows an agent to get information by accessing external 
software packages. 

We also note that, although the GonGolog language does not support sensing primitives, 
IndiGolog does, and that sensing in the situation calculus is discussed by (.Reiter 200 ill . 

Concurrency. ConGolog provides different constructs for concurrent execution of pro- 
cesses; these processes may be either internal to a single agent or may represent different 
agents executing concurrently. Thus, GonGolog supports both concurrency of actions in- 
side an agent and concurrency of agents. 

The same holds for £hhf , where it is possible to concurrently execute either goals internal 
to a single agent or goals for activating different agents. As an example of the last case, 
if different agents were characterized by a cycle like the one depicted for the seller agent, 
it would be possible to prove a goal like agentl-cycle \\ agentl-cycle \\ ... \\ agentN-cycle 
meaning that agentl to agentN are executed concurrently. 

As far as IMPACT is concerned, it associates a body of code implementing a notion of 
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concurrency to each agent in the system, to specify how concurrent actions internal to the 
agent must be executed. Concurrency among agents cannot be explicitly specified. 

The converse situation takes place with Concurrent METATEM, where concurrency of 
internal actions is not supported; a Concurrent METATEM specification defines a set of 
concurrently executing agents which are not able to execute internal concurrent actions. 

Both Dylog and AGENT-0 do not support concurrency at the language level. 

Nondeterminism. ConGolog allows for nondeterministic choice between actions, nonde- 
terministic choice of arguments and nondeterministic iteration. 

Nondeterminism in the IMPACT language derives from the fact that the feasible, rational 
and reasonable status sets giving the semantics to agent programs are not unique, thus 
introducing nondeterminism in the agent's behavior 

In Dylog and £hh} nondeterminism is introduced, as in usual logic programming set- 
tings, by the presence of more procedures (rules, in Shhf) defining the same predicate. 

The main source of nondeterminism in Concurrent METATEM is due to nondeterminis- 
tic temporal operators such as "sometime in the past", "sometime in the future", which do 
not identify a specific point in time, but may be verified in a range of time points. 

AGENT-0 does not seem to support any kind of nondeterministic behavior 

Agent knowledge. A GonGolog model can include the specification of the agents' mental 
states, i.e., what knowledge and goals they have, specified in a purely declarative way 
( [Shapiro et al. 1998) . With respect to incomplete knowledge, 

ConGolog can accommodate incompletely specified models, both in the sense that the initial 
state of the system is not completely specified, and in the sense that the processes involved are 
nondeterministic and may evolve in any number of ways (Lesperanc e and Shapiro 1999t . 

AGENT-0 allows for expressing beliefs, capabilities, commitments, obligations. It does 
not allow the representation of intentions, goals and desires and it does not support rea- 
soning mechanisms in presence of incomplete knowledge or uncertainty. PLAGA adds 
intentions and plans to the data structures provided by AGENT-0. 

Beliefs of IMPACT agents consist of the values returned by the packages accessed by 
the agent by means of the code call mechanism. No intentions and desires are ascribed 
to IMPACT agents: an IMPACT agent is characterized by its obligations, permissions, 
prohibitions. Two extensions of basic IMPACT agent programs, namely probabilistic and 
meta agent programs, can deal with uncertainty and beliefs about other agents beliefs, 
respectively. 

Beliefs of Dylog agents are represented by the values of the functional fluents char- 
acterizing the agent's knowledge. These values range over true, false and unknown. The 
"unknown" value allows Dylog agents to reason in presence of incomplete knowledge, as 
discussed by fBald oni et al. 20011 1. Agents can perform hypothetical reasoning on possible 
sequences of actions by exploring different alternatives. Recent extensions allow Dylog 
agents to represent beliefs of other agents in order to reason about conversation protocols 
(IBaldoni et al. 2003al IBaldoni et al.'20 03b i. 

The beliefs of Concurrent METATEM agents in a given time point consist of the set 
of predicates true in that time point. Adding deliberation and explicit beliefs to Con- 
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current METATEM agents is discussed in ( IFisher 19 97t and the extension of Concurrent 
METATEM agents with confidence is dealt with in (fisher and Ghidini 2002 1. 

In Ehhf behefs are represented by true facts. Goals are neither expUcitly represented nor 
maintained in persistent data structures during the agent execution: they are managed in the 
usual way in a logic programming setting. Ehhf does not provide language constructs for 
representing desires, intentions and other mental attitudes, but it may be adopted to model 
a BDI architecture dBozzano et al. 1999^1 . 

Communication. The specification of communicative multiagent systems in ConGolog is 
discussed in ( [Shapiro et al. 1998 ). A meeting scheduler multiagent system example is used 
to show in practice the proposed approach. 

Among AGENT-0 language constructs, there are the INFORM, REQUEST and UNRE- 
QUEST communicative actions which constitute a set of performatives upon which any 
kind of communication can be built. Communication in AGENT-0 is quite rigid since, 
for agent A to request an action to agent B it is necessary to know the exact syntax of 
the requested action. The receiver agent has no means to understand the content of a re- 
quest and perform an action consequently, if the action to be performed is not exactly 
specified as the content of the message itself. This is clearly a strong limitation, which 
recent agent communication languages, such as KQML (May fiel d et al. 1995t and FlPA 
ACL ([Foundation for Intelligent Physical A gents 2002") have partially addressed. The inte- 
gration of AGENT-0 and KQML proposed in (Davies a nd Edwards 1994 i aims at making 
communication management in AGENT-0 more flexible. 

The same limitation affecting AGENT-0 also affects Concurrent METATEM: every 
agent has a communicative interface which the other agents in the system must know in 
order to exchange information. Despite this limitation. Concurrent METATEM has been 
proposed both as a coordination language dKellett and Fisher 1997b> and as a language 
for forming groups of agents where agents have the ability to broadcast messages to the 
members of a group ( Fis her and Kakoudakis 2000, Fisher 199 8 1. 

The IMPACT language does not provide communication primitives as part of the lan- 
guage, but among the software packages an agent may access there is a msgbox package 
providing message box functionalities. Messages can have any form, adhering to some 
existing standard or being defined ad-hoc for the application. 

In dBaldoni et al. 2003bl Dylog agents are enriched with a communication kit including 
a primitive set of speech acts, a set of special "get message" actions and a set of conversa- 
tion protocols. Exchanged messages are based on ( [Foundation for Intelligent Physical Agents 2002| l. 

An agent behavior driven by the reception of a message and the verification of a con- 
dition on the current state can be easily modeled in Ehhf - In dBozzano et al. 1999a> the 
translation of rules "on receiving Messagein check Condition update State send Message- 
Ouf" into Ehhf is shown. Messages can have any form. 

Team working. The attention devoted to teamwork in a MAS setting is quite recent. For 
this reason, none of the languages discussed so far encapsulates explicit constructs for team 
specification and programming. The developer can define protocols for forming teams and 
she/he can try to program agents which respect the given protocol. According to the support 
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given to communication (previous paragraph), the task of defining such protocols may be 
more or less difficult. 

With respect to the six languages we analyzed in this paper, the only papers explicitly 
addressing the problem of forming groups are JFisher and Kakoudakis 2 00(1 Fis her 1998> 
dealing with flexible grouping in Concurrent METATEM. In Concurrent METATEM, a 
group is essentially a set consisting of both agents and further sub-groups. The basic prop- 
erties of groups are that agents are able to broadcast a message to the members of a group, 
add an agent to a group, ascertain whether a certain agent is a member of a group, remove 
a specified agent from a group, and construct a new subgroup. 

We are not aware of similar extensions of ConGolog, AGENT-0, IMPACT, Dylog and 
£hhs- 

Heterogeneity and knowledge sharing. Agents programmed in the same language have 
the potential to interact without respecting any specific condition. Whether the agents will 
interact or not depends on the correctness of their code with respect to the specification 
of the application. Whatever the language used is, if agent A sends a message Message 
to agent B and the code of agent B does not include rules (or imperative statements, or 
clauses) for managing Message, A and B will not be able to engage in a dialog. 

Among the six languages discussed in this paper, IMPACT is the most suitable one to 
cope with heterogeneity of data sources. Any information source or software application 
can be accessed through an IMPACT program, provided it is properly "agentified". IM- 
PACT can be seen as a programming layer providing a uniform access to heterogeneous 
sources of information and applications. 

The other five languages are not conceived for accessing heterogeneous data sources and 
for integrating the information contained in the data sources: they provide no support for 
these two tasks. 

In all of the six languages, agents may take advantage of sharing the same ontology to 
interact, but they are not forced to do so. To make an example, Dylog agents can refer 
to a common ontology contained in the domain knowledge. This approach is described in 
fBaldon Tet al. 20031 . However, it is also possible to develop Dylog agents without expUc- 
itly defining a common ontology. When developing a MAS, the developer has in mind the 
ontology the agents will refer to. Although it is a good practice to make it expHcit, this is 
not compulsory to guarantee the MAS working. 

Programming style. The constructs provided by ConGolog allow to mimic both goal- 
directed reasoning ("if the current goal is G then call the procedure to achieve G") and 
reactiveness ("interrupt as soon as the condition C becomes true"). 

AGENT-0 programming style is reactive: depending on the message received by the 
agent and on its current beliefs, a commitment rule can be used. 

IMPACT implements a forward reasoning mechanism: the interpreter looks for all the 
action status atoms which are true with respect to the current state, the agent program and 
the agent integrity constraints. 

For Dylog a goal directed proof procedure is defined, which allows to compute a query 
from a given dynamic domain description. 



54 



V. Mascardi, M. Martelli and L. Sterling 



Concurrent METAT EM is defined as a language for modeling reactive systems JFisher 1993> . 
Thus, reactiveness is the predominant feature of Concurrent METATEM agents. 
£hhf supports a Prolog-like goal-directed reasoning mechanism. 

All of the six languages are flexible enough to specify/implement agents adhering to 
different agent models. 

Modularity. All the languages described in this paper support modularity at the agent level, 
since they allow the definition of each agent program separately from the definition of the 
other agents. 

ConGolog and Dylog both support the definition of procedures. In ConGolog these 
procedures are defined by macro expansion into formulae of the situation calculus, while 
in Dylog they are defined as axioms in the dynamic modal logic. 

AG ENT-0 does not support the definition of procedures, even if in Section 6.3 of JShoham 1993t 
macros are used for readability sake. The macro expansion mechanism is not supported by 
the AGENT-0 implementation. 

£hhf supports the definition of procedures as logic programming languages do, by defin- 
ing rules for solving a goal. 

Finally, IMPACT and Concurrent METATEM do not allow the definition of procedures. 

Semantics. All the languages discussed in this survey, except for AGENT-0, have a formal 
semantics. 

Semantics of GonGolog is given as a transition semantics by means of the predi- 
cates Final{d, s) and Trans{5, s, S' , s'). The possible configurations that can be reached 
by a program S in situation s are those which are obtained by repeatedly following the 
transition relation starting from {S, s) and which are final. Different interpreters for lan- 
guages extending or slightly modifying GonGolog have been proven correct with respect 
to the intended semantics of the language. See for example t,De Giacomo e t al . 2000b . 
JMcIh-aith and Son 2002t and JSon et al. 2001> . 

There are three different semantics which can be associated with an IMPACT agent 
program, given its current state and integrity constraints: the feasible, rational and rea- 
sonable status set semantics. Reasonable status set semantics is more refined than the 
rational one, which is more refined than the feasible one. All of them are defined as a 
set of action status atoms of the form 'Doa{t) that are true with respect to the agent 
program V, the current state O and the set 2C of underlying integrity constraints. In 
I IEiterand Subrahmanian 1999t algorithms for evaluating the semantics of arbitrary agent 
programs are proposed and their complexity is evaluated; computing the reasonable sta- 
tus set semantics of a proper subset of IMPACT agent programs, called regular agents, is 
possible in polynomial time, as demonstrated in (Eiter et al. 2000 1. 

The logical characterization of Dylog is provided in two steps. First, a multimodal logic 
interpretation of a dynamic domain description which describes the monotonic part of 
the language is introduced. Then, an abductive semantics to account for non-monotonic 
behavior of the language is provided. Dylog is defined by a proof procedure which is 
sound and complete with respect to the Kripke semantics of modal logic. 

The semantics of Concurrent METATEM is the one defined for the first-order tempo- 
ral logic FML. It is a Kripke-style semantics given by the \= relation that assigns the truth 
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value of a formula in a model at a particular moment in time i and with respect to a vari- 
able assignment. The soundness, completeness and termination of the resolution procedure 
discussed in dFisher 1991> have been established. 

The Shhf operational semantics is given by means of a set of rules describing the way 
sequents can be rewritten. According to the proof as computation interpretation of linear 
logic, sequents represent the state of a computation. Soundness and completeness results 
are established with respect to linear logic. 



10 Related Work 

To the best of our knowledge, there are only few previous attempts to analyze and compare 
a large set of logic-based formalisms and calculi for multiagent systems. 

Some issues such as Kripke models and possible world semantics, Shoham's AGENT-0, 
Concurrent METATEM etc. are briefly surveyed in ( jWooldridge and Jennings 1995f but 
not specifically in a logic -based perspective. 

A discussion on the adoption of logic programming and non-monotonic reasoning for 
evolving knowledge bases (and, more in general, for intelligent agents) can be found 
in (ILeite 2003> . The book focuses on logic programming for non-monotonic reasoning 
and on languages for updates. It analyzes and compares LUPS f Alferes et al. 20021 . EPI 
(Eiter et al. 2001 1 and introduces their extensions KUL and KABUL. For some of the lan- 
guages discussed in (ILeite 2003> a working interpreter exists: see ( [Implementations of Logic Programs Updates Home Pa] 
for details. We will shortly describe LUPS and KABUL in the sequel as representative ex- 
amples of languages of updates. 

The work which shares more similarities with ours is the paper ''Computational Logic 
and Multi-Agent Systems: a Roadmap" dSadri and T oni 1999 1. That paper discusses dif- 
ferent formalisms with respect to the representation of the agent's mental state, the agent 
life-cycle, the ability to communicate following complex interaction protocols and the 
capability of representing and reasoning about other agents' beliefs. The languages and 
systems analyzed in Sadri and Toni's roadmap include INTERRAP (Miiller et al. 19981 
[Jung and Fisher 1997|lMtiUer 1996j . 3APL (.Hindriks et al. 1998. Dastani et al. 2003j . and 

flie work by dKowalski and Sadri 19991 . dShanahan 2000t . JBaral and Ge fond 2000t . ( |Pereira and Quaresma 1998| l, 
dGelder et al. 19881 . jPelFAcqua et al 1998| l, ( jPelFAcqua et al 1999> , ( pell'Acqua and Pereira 1999) , 
dHindriks et al. 1999> . ( |Carbogim and Robertson 199 9'^ and f Poole 1997V Our paper com- 
plements Sadri and Toni's survey because, apart from the IMPACT language and part of 
the work on CaseLP which are also discussed by Sadri and Toni, we analyze different lan- 
guages and approaches from different perspectives. Sadri and Toni mainly aim at putting 
in evidence the contribution of logic to knowledge representation formalisms and to basic 
mechanisms and languages for agents and MAS modeling. Our paper analyzes a subset of 
logic-based executable languages whose main features are their suitability for specifying 
agents and MASs and their possible integration in the ARPEGGIO framework. We think 
that a researcher interested in logic-based approaches to multiagent systems modeling and 
prototyping can find an almost complete overview in reading both Sadri and Toni's paper 
and ours. 

Other relevant logic-based approaches that are dealt with neither in ("Sadri a nd Toni 1999b 
nor in this work are ALIAS, LUPS, KABUL, AgentSpeak(L) and the KARO framework. 
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Given more time and space, they could fit in the picture and in the future we would like to 
check the feasibility of incorporating some of them in the ARPEGGIO framework. 

ALIAS (Abductive Logic Agents ( Ciam polini et al. 2003^ ) is an agent architecture based 
on intelligent and social logic agents where the main form of agent reasoning is abduction. 
ALIAS agents can coordinate their reasoning with other agents following several coor- 
dination schemas. In particular, they can either cooperate or compete in the solution of 
problems. The ALIAS architecture is characterized by two separate layers: the lower layer 
involves reasoning while the upper layer involves social behavior. 

Agent reasoning is specified by abductive logic programs consisting of a set of clauses 
Head :- Body, where Head is an atom and Body is a conjunction of literals (atoms and 
negation of atoms), plus a set of abducible predicates and a set of integrity constraints. 

Agent interaction and coordination is specified in a logic language named LAILA (Lan- 
guage for Abductive Logic Agents) suitable for modeling agent structures from the view- 
point of social behavior LAILA provides high-level declarative operators such as the com- 
munication operator >, the competition operator ;, the collaboration operator & and a 
down-reflection operator | which allows a local abductive resolution to be triggered. The 
operational semantics of LAILA is discussed in ( |Ciampolini et al. 2003| l. 

The distinguishing features of ALIAS consist of its support for (i) coordinating the rea- 
soning of agents at a high level of abstraction, (ii) explicitly referring to the hypothetical 
reasoning capabilities of agents from within the language, and (iii) providing the tools to 
maintain the system (or part of it) consistent with respect to the integrity constraints. 

A prototypical version of ALIAS has been implemented on top of Jinni ( |Jinni Home Page 2003^ , 
a logic programming language extended with primitives for concurrent programming. 

The main difference between ALIAS and the six languages discussed in our paper lies in 
the background logic upon which the languages are based: ALIAS is based on first-order 
logic while all the six languages discussed in this paper encapsulate features of linear, 
modal or temporal extensions of first-order logic. 

ALIAS shares with Concurrent METATEM and AGENT-0 the support for communi- 
cation at the language level. However, the communication primitives provided by ALIAS, 
associated with a semantics of collaboration and competition and with the local abductive 
reasoning operator (down-reflection), are more expressive than those provided by Concur- 
rent METATEM and AGENT-0 and more suitable for tackling problems that require the 
coordination of agent reasoning in presence of incomplete knowledge. 

The agent reasoning form (abduction) is a shared feature between ALIAS and Dylog. 

The language LUPS ("tAe language for dynamic updafes" JAIferes et al. 20021 1 is based 
on a notion of update commands that allow the specification of logic programs. Each com- 
mand in LUPS can be issued in parallel with other LUPS commands and specifies an 
update action, basically encoding the assertion or retraction of a logic program rule. An 
extension to LUPS, EPI ( "the lansuase around" dETter et al. 200 lH . introduces the ability 
to access external observations and make the execution of programs dependent on both 
external observations and concurrent execution of other commands. EVOLP {EWOlving 
Logic Programs cAlferes et al. 2002^ ) integrates in a simple way the concepts of both Dy- 
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KABUL (Knowledge And Behavior Update Language JLeite 2003> ) overcomes some 
limitations of LUPS. In particular, it allows the specification of updates that depend on a 
sequence of conditions ("assert a rule R if some condition Condi is true after some con- 
dition Condi was true"), delayed effects of actions, updates that should be executed only 
once, updates that depend on the concurrent execution of other commands, updates that 
depend on the presence or absence of a specific rule in the knowledge base, and inhibition 
of a command. Moreover, with respect to LUPS, KABUL provides more flexible means to 
specify updates that will occur in the future and to deal with effects of actions. 

AgentSpeak(L) JRao 1996t is a programming language based on a restricted first order 
language with events and actions. The behavior of the agent is dictated by the programs 
written in AgentSpeak(L). The beliefs, desires and intentions of the agent are not explic- 
itly represented as modal formulae. The current state of the agent, which is a model of 
itself, its environment and other agents, is viewed as its current belief state; states which 
the agent wants to bring about based on its external or internal stimuli can be viewed as 
desires; and the adoption of programs to satisfy such stimuli can be viewed as intentions. 
An operational semantics of AgentSpeak(L) is provided, as well as the proof theory of the 
language. AgentSpeak(XL) ( Bordini et al. 2002 1 integrates a task scheduler into AgentS- 
peak(L) to ensure an efficient intention selection. The paper JHindriks et al. 1998t demon- 
strates that every agent which can be programmed in AgentSpeak(L) can be programmed 
in the already cited 3APL language. The authors of ( Hindriks et al. 1998j write that, in 
their opinion, the converse (simulating 3APL by AgentSpeak(L)) is not feasible and thus 
they conjecture that 3APL has strictly more expressive power than AgentSpeak(L). A 
simulation of ConGolog by 3APL has also been provided JHindriks et al. 2000a showing 
that 3APL and ConGolog are closely related languages. 

The framework KARO {Knowledge, Abilities, Results and Opportunities Jvan Linder et al. 19951 1 ) 
formalizes motivational attitudes situated at two different levels. At the assertion level (the 
level where operators deal with assertions), preferences and goals are dealt with. At the 
practition level (the level where operators range over actions) commitments are defined. 
The main informational attitude of the KARO framework is knowledge. The fact that agent 
i knows tf is represented by the formula Kiip and is interpreted in a Kripke-style possible 
worlds semantics. At the action level results, abilities and opportunities are considered. The 
abilities of an agent are formalized via the A, operator: A; a denotes the fact that agent i 
has the ability to do a. Dynamic logic is used to formalize the notions of opportunities and 
results, doi (a) refers to the performance of action a by the agent i. The formula {doi {a))f 
represents the fact that agent i has the opportunity to do a and that doing a leads to (p. The 
formula [doi {a)]ip states that if the opportunity to do a is indeed present, doing a results in 
(fi. Starting from these basic attitudes, preferences, goals and commitments can be modeled. 
Different methods for realizing automated reasoning within agent-based systems modeled 
using the KARO framework are discussed in (.Hustadt et al. 2001a..Hustadt et al. 2001bt . 
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11 Conclusion 

In this paper we have systematically analyzed and compared six logic-based and executable 
MAS specification languages. Although these languages were chosen on the basis of their 
potential to be integrated in the ARPEGGIO framework, they are an interesting and rep- 
resentative set of formalisms based on extensions of first order logic. We have discussed 
the logic -based formalisms upon which the languages are built to allow the reader to un- 
derstand the theoretical foundations of the languages. We have demonstrated the use of 
these languages by means of an example, and we have compared them along twelve di- 
mensions. Finally, we have surveyed other approaches adopting computational logic for 
MAS specification. 

Various advantages in using logic-based approaches for modeling and prototyping agents 
and MAS should emerge from this paper: as pointed out by Wooldridge and Jennings in 
Section 2 of ("Wooldridge and Jennings IQQS"! agents are often modeled in terms of mental 
attitudes such as beliefs, desires, intentions, choices and commitments. The main advan- 
tage in using logic and modal logic in particular for modeling intentional systems is that it 
allows to easily and intuitively represent intentional notions without requiring any special 
training. The possible world semantics usually adopted for modal languages has differ- 
ent advantages: it is well studied and well understood, and the associated mathematics 
of "correspondence theory" is extremely elegant. Formal languages that support temporal 
operators are a powerful means for specifying sophisticated reactive agents in a succinct 
fashion. Moreover, since agents are expected to act, languages based on formal theories 
of action such as dynamic logic and the situation calculus are extremely suitable to model 
agents' ability to perform actions. 

According to the observations above, if we compare logic languages and object-oriented 
formalisms for the specification of agents we note that logic languages are more suitable 
than object-oriented languages to model agents. According to (Odell 2002 1 autonomy and 
interaction are the key features which differentiate agents and objects. Autonomy has two 
independent aspects: dynamic autonomy and nondeterministic autonomy. Agents are dy- 
namic because they can exercise some degree of activity, rather than passively providing 
services. With respect to dynamic autonomy, agents are similar to active objects. By means 
of the running example we have shown that logic -based languages are suitable for express- 
ing the active behavior of agents in a concise and simple way. Agents may also employ 
some degree of unpredictable (or nondeterministic) behavior We have shown that all of 
the six languages analyzed in this paper support some kind of nondeterminism. The "or" 
connective and the "exists" quantifier introduce a degree of nondeterminism to all the lan- 
guages based on first order logic. Interaction implies the ability to communicate with the 
environment and other entities. Object messages (method invocation) can be seen as the 
most basic form of interaction. A more complex degree of interaction would include those 
agents that can react to observable events within the environment. And finally in multiagent 
systems, agents can be engaged in multiple, parallel interactions with other agents. Logic- 
based languages prove their suitability in modeling agents that react to an event (logical 
implications of the form if the event E took place then something becomes true can be used 
for this purpose) and to reason about sophisticated conversations. 

The last consideration of our paper deals with the implementation of a MAS prototype: 
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we have seen that different languages among the ones we discussed have an interpreter 
which extends logic programming in some way. Using a logic programming language for 
MAS prototyping has different advantages: 

• MAS execution: the evolution of a MAS consists of a nondeterministic succession 
of events; from an abstract point of view a logic programming language is a nonde- 
terministic language in which computation occurs via a search process. 

• Meta-reasoning capabilities: agents may need to dynamically modify their behavior 
so as to adapt it to changes in the environment. Thus, the possibility given by logic 
programming of viewing programs as data is very important in this setting. 

• Rationality and reactiveness of agents: the declarative and the operational interpre- 
tation of logic programs are strictly related to the main characteristics of agents, i.e., 
rationality and reactiveness. In fact, we can think of a pure logic program as the 
specification of the rational component of an agent and we can use the operational 
view of logic programs (e.g. left-to-right execution, use of non-logical predicates) 
to model the reactive behavior of an agent. The adoption of logic programming for 
combining reactivity and rationality is described in (IKowalski and Sadri 1996t . 
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